<?xml version='1.0' encoding='UTF-8'?>
<akomaNtoso xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0">
  <act name="act">
    <meta>
      <identification source="#lex-au">
        <FRBRWork>
          <FRBRthis value="/akn/au/act/2024/128/!main"/>
          <FRBRuri value="/akn/au/act/2024/128"/>
          <FRBRdate date="2024-01-01" name="Generation"/>
          <FRBRauthor href="#parliament"/>
          <FRBRcountry value="au"/>
          <FRBRsubtype value="act"/>
          <FRBRnumber value="128"/>
          <FRBRname value="privacy-and-other-legislation-amendment-act-2024"/>
          <FRBRprescriptive value="true"/>
          <FRBRauthoritative value="true"/>
        </FRBRWork>
        <FRBRExpression>
          <FRBRthis value="/akn/au/act/2024/128/eng@2024-12-10/!main"/>
          <FRBRuri value="/akn/au/act/2024/128/eng@2024-12-10"/>
          <FRBRdate date="2024-12-10" name="Generation"/>
          <FRBRauthor href="#parliament"/>
          <FRBRlanguage language="eng"/>
        </FRBRExpression>
        <FRBRManifestation>
          <FRBRthis value="/akn/au/act/2024/128/eng@2024-12-10/!main.akn"/>
          <FRBRuri value="/akn/au/act/2024/128/eng@2024-12-10/!main.akn"/>
          <FRBRdate date="2026-07-14" name="Generation"/>
          <FRBRauthor href="#lex-au"/>
        </FRBRManifestation>
      </identification>
      <references source="#lex-au">
        <TLCOrganization eId="parliament" href="/ontology/organization/au/parliament" showAs="Parliament of Australia"/>
        <TLCOrganization eId="lex-au" href="https://github.com/cchew/lex-au" showAs="lex-au"/>
        <TLCConcept eId="custodialSentence" href="/ontology/concept/au/custodialSentence" showAs="term of imprisonment"/>
        <TLCConcept eId="deadline" href="/ontology/concept/au/deadline" showAs="deadline"/>
        <TLCConcept eId="penaltyUnit" href="/ontology/concept/au/penaltyUnit" showAs="penalty unit"/>
        <TLCRole eId="commissioner" href="/ontology/roles/au/commissioner" showAs="the Commissioner"/>
        <TLCRole eId="information-commissioner" href="/ontology/roles/au/information-commissioner" showAs="Information Commissioner"/>
        <TLCRole eId="minister" href="/ontology/roles/au/minister" showAs="the Minister"/>
      </references>
    </meta>
    <preface>
      <p>Privacy and Other Legislation Amendment Act 2024</p>
      <p>No. 128, 2024</p>
      <p>An Act to amend the law in relation to privacy and the criminal law, and for related purposes</p>
      <p>Contents</p>
      <p>1	Short title	1</p>
      <p>2	Commencement	2</p>
      <p>3	Schedules	3</p>
      <p>4	Review of operation of amendments made by Schedule 3	3</p>
      <p>Schedule 1—Privacy reforms	4</p>
      <p><ref href="#part-1">Part 1</ref>—Objects of the Act	4</p>
      <p>Privacy Act 1988	4</p>
      <p><ref href="#part-2">Part 2</ref>—APP codes	5</p>
      <p>Privacy Act 1988	5</p>
      <p><ref href="#part-3">Part 3</ref>—Emergency declarations	8</p>
      <p>Privacy Act 1988	8</p>
      <p><ref href="#part-4">Part 4</ref>—Children’s privacy	14</p>
      <p>Privacy Act 1988	14</p>
      <p><ref href="#part-5">Part 5</ref>—Security, retention and destruction	18</p>
      <p>Privacy Act 1988	18</p>
      <p><ref href="#part-6">Part 6</ref>—Overseas data flows	19</p>
      <p>Privacy Act 1988	19</p>
      <p><ref href="#part-7">Part 7</ref>—Eligible data breaches	21</p>
      <p>Privacy Act 1988	21</p>
      <p><ref href="#part-8">Part 8</ref>—Penalties for interference with privacy	31</p>
      <p>Data Availability and Transparency Act 2022	31</p>
      <p>Digital ID Act 2024	31</p>
      <p>Identity Verification Services Act 2023	31</p>
      <p>Privacy Act 1988	31</p>
      <p><ref href="#part-9">Part 9</ref>—Federal court orders	40</p>
      <p>Privacy Act 1988	40</p>
      <p><ref href="#part-10">Part 10</ref>—Commissioner to conduct public inquiries	42</p>
      <p>Privacy Act 1988	42</p>
      <p><ref href="#part-11">Part 11</ref>—Determinations following investigations	46</p>
      <p>Privacy Act 1988	46</p>
      <p><ref href="#part-12">Part 12</ref>—Annual reports	47</p>
      <p>Australian Information Commissioner Act 2010	47</p>
      <p><ref href="#part-13">Part 13</ref>—External dispute resolution	48</p>
      <p>Privacy Act 1988	48</p>
      <p><ref href="#part-14">Part 14</ref>—Monitoring and investigation	49</p>
      <p>Competition and Consumer Act 2010	49</p>
      <p>Crimes Act 1914	49</p>
      <p>Data-matching Program (Assistance and Tax) Act 1990	49</p>
      <p>National Health Act 1953	50</p>
      <p>Privacy Act 1988	50</p>
      <p><ref href="#part-15">Part 15</ref>—Automated decisions and privacy policies	60</p>
      <p>Privacy Act 1988	60</p>
      <p>Schedule 2—Serious invasions of privacy	62</p>
      <p>Privacy Act 1988	62</p>
      <p>Schedule 3—Doxxing offences	81</p>
      <p>Criminal Code Act 1995	81</p>
      <p>Privacy and Other Legislation Amendment Act 2024</p>
      <p>No. 128, 2024</p>
      <p>An Act to amend the law in relation to privacy and the criminal law, and for related purposes</p>
      <p>[<i>Assented to 10 December 2024</i>]</p>
      <formula name="enacting">
        <p>The Parliament of Australia enacts:</p>
      </formula>
    </preface>
    <body>
      <section eId="sec-1">
        <num>1</num>
        <heading>Short title</heading>
        <content>
          <p>		This Act is the <i>Privacy and Other Legislation Amendment</i><i> Act </i><i>2024</i>.</p>
        </content>
      </section>
      <section eId="sec-2">
        <num>2</num>
        <heading>Commencement</heading>
        <subsection eId="sec-2__subsec-1">
          <num>1</num>
          <content>
            <p>Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.</p>
          </content>
          <table>
            <tr>
              <th>Commencement information</th>
              <th>Commencement information</th>
              <th>Commencement information</th>
            </tr>
            <tr>
              <td>Column 1</td>
              <td>Column 2</td>
              <td>Column 3</td>
            </tr>
            <tr>
              <td>Provisions</td>
              <td>Commencement</td>
              <td>Date/Details</td>
            </tr>
            <tr>
              <td>1.  Sections 1 to 4 and anything in this Act not elsewhere covered by this table</td>
              <td>The day this Act receives the Royal Assent.</td>
              <td>10 December 2024</td>
            </tr>
            <tr>
              <td>2.  Schedule 1, Parts 1 to 7</td>
              <td>The day after this Act receives the Royal Assent.</td>
              <td>11 December 2024</td>
            </tr>
            <tr>
              <td>3.  Schedule 1,  items 45 and 46</td>
              <td>Immediately after the commencement of the provisions covered by table item 5.</td>
              <td>11 December 2024</td>
            </tr>
            <tr>
              <td>4.  Schedule 1,  item 47</td>
              <td>The later of:
(a) immediately after the commencement of the provisions covered by table item 5; and
(b) immediately after the commencement of the Digital ID Act 2024.</td>
              <td>11 December 2024
(paragraph (a) applies)</td>
            </tr>
            <tr>
              <td>5.  Schedule 1, items 48 to 58</td>
              <td>The day after this Act receives the Royal Assent.</td>
              <td>11 December 2024</td>
            </tr>
            <tr>
              <td>6.  Schedule 1, Parts 9 to 14</td>
              <td>The day after this Act receives the Royal Assent.</td>
              <td>11 December 2024</td>
            </tr>
            <tr>
              <td>7.  Schedule 1, Part 15</td>
              <td>The day after the end of the period of 24 months beginning on the day this Act receives the Royal Assent.</td>
              <td>10 December 2026</td>
            </tr>
            <tr>
              <td>8.  Schedule 2</td>
              <td>A single day to be fixed by Proclamation.
However, if the provisions do not commence within the period of 6 months beginning on the day this Act receives the Royal Assent, they commence on the day after the end of that period.</td>
              <td></td>
            </tr>
            <tr>
              <td>9.  Schedule 3</td>
              <td>The day after this Act receives the Royal Assent.</td>
              <td>11 December 2024</td>
            </tr>
          </table>
          <authorialNote placement="end" eId="note-1" marker="1">
            <content>
              <p>Note:	This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.</p>
            </content>
          </authorialNote>
        </subsection>
        <subsection eId="sec-2__subsec-2">
          <num>2</num>
          <content>
            <p>Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.</p>
          </content>
        </subsection>
      </section>
      <section eId="sec-3">
        <num>3</num>
        <heading>Schedules</heading>
        <content>
          <p>Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms.</p>
        </content>
      </section>
      <section eId="sec-4">
        <num>4</num>
        <heading>Review of operation of amendments made by Schedule 3</heading>
        <subsection eId="sec-4__subsec-1">
          <num>1</num>
          <content>
            <p><role refersTo="#minister">The Minister</role> must cause an independent review to be undertaken of the operation of the amendments made by Schedule 3 to this Act.</p>
          </content>
        </subsection>
        <subsection eId="sec-4__subsec-2">
          <num>2</num>
          <content>
            <p>The review must commence as soon as practicable after the end of the period of 24 months starting at the commencement of that Schedule.</p>
          </content>
        </subsection>
        <subsection eId="sec-4__subsec-3">
          <num>3</num>
          <content>
            <p>The persons who undertake the review must give the Minister a written report of the review <quantity refersTo="#deadline">within 6 months</quantity> of the commencement of the review.</p>
          </content>
        </subsection>
        <subsection eId="sec-4__subsec-4">
          <num>4</num>
          <content>
            <p><role refersTo="#minister">The Minister</role> must cause a copy of the report of the review to be tabled in each House of the Parliament within 15 sitting days of that House after the report is given to <role refersTo="#minister">the Minister</role>.</p>
          </content>
        </subsection>
      </section>
    </body>
    <attachments>
      <attachment>
        <hcontainer name="schedule" eId="schedule-1">
          <heading>Privacy reforms</heading>
          <content>
            <p>Privacy Act 1988</p>
          </content>
          <hcontainer name="clause" eId="schedule-1__clause-1">
            <num>1</num>
            <heading>Paragraph 2A(a)</heading>
            <content>
              <p>Repeal the paragraph, substitute:</p>
            </content>
            <paragraph eId="schedule-1__clause-1__para-a">
              <num>a</num>
              <content>
                <p>to promote the protection of the privacy of individuals with respect to their personal information; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-1__para-aa">
              <num>aa</num>
              <content>
                <p>to recognise the public interest in protecting privacy; and</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-2">
            <num>2</num>
            <heading>Paragraph 2A(h)</heading>
            <content>
              <p>Omit “obligation”, substitute “obligations”.</p>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-3">
            <num>3</num>
            <heading>Subsection 6(1)</heading>
            <content>
              <p>Insert:</p>
              <p><b><i>temporary APP code</i></b>: see section 26GB.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-4">
            <num>4</num>
            <heading>Section 26G (at the end of the heading)</heading>
            <content>
              <p>Add “<b>—following a request</b>”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-5">
            <num>5</num>
            <heading>After section 26G</heading>
            <content>
              <p>Insert:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26GA">
            <num>26GA</num>
            <heading>Development of APP codes by the Commissioner—at the direction of the Minister</heading>
            <content>
              <p>Minister may give direction</p>
              <p>Commissioner must develop and register code</p>
              <p>Matters covered by code</p>
              <p>Consultation etc.</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-26GA__subclause-1">
              <num>1</num>
              <content>
                <p>	(1)	The Minister may, in writing, direct the Commissioner to develop an APP code if the Minister<i> </i>is satisfied that it is in the public interest:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26GA__para-a">
              <num>a</num>
              <content>
                <p>to develop the code; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GA__para-b">
              <num>b</num>
              <content>
                <p>for <role refersTo="#commissioner">the Commissioner</role> to develop the code.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26GA__subclause-2">
              <num>2</num>
              <content>
                <p>Without limiting subsection (1), a direction under that subsection may:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26GA__para-a">
              <num>a</num>
              <content>
                <p>specify one or more matters that the code must deal with; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GA__para-b">
              <num>b</num>
              <content>
                <p>specify the APP entities, or a class of APP entities, that are to be bound by the code.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26GA__subclause-3">
              <num>3</num>
              <content>
                <p>A direction under subsection (1) is not a legislative instrument.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GA__subclause-4">
              <num>4</num>
              <content>
                <p><role refersTo="#commissioner">The Commissioner</role> must develop and register an APP code if <role refersTo="#minister">the Minister</role> has given <role refersTo="#commissioner">the Commissioner</role> a direction under subsection (1) to develop the code.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GA__subclause-5">
              <num>5</num>
              <content>
                <p>Despite paragraph 26C(3)(b), the APP code must not cover an act or practice that is exempt <ref href="#sec-7B__subsec-1">within the meaning of subsection 7B(1)</ref>, (2) or (3).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GA__subclause-6">
              <num>6</num>
              <content>
                <p>In developing the APP code, <role refersTo="#commissioner">the Commissioner</role> may consult any person <role refersTo="#commissioner">the Commissioner</role> considers appropriate.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GA__subclause-7">
              <num>7</num>
              <content>
                <p>Before registering the APP code under <role refersTo="#commissioner">the Commissioner</role> must:<ref href="#sec-26H">section 26H</ref>, </p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26GA__para-a">
              <num>a</num>
              <content>
                <p>make a draft of the code publicly available; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GA__para-b">
              <num>b</num>
              <content>
                <p>invite the public to make submissions to <role refersTo="#commissioner">the Commissioner</role> about the draft within a specified period (which must run for at least 40 days); and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GA__para-c">
              <num>c</num>
              <content>
                <p>give consideration to any submissions made within the specified period.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26GB">
            <num>26GB</num>
            <heading>Development of APP codes by the Commissioner—temporary APP codes</heading>
            <content>
              <p>Minister may give direction</p>
              <p>Commissioner must develop and register code</p>
              <p>Matters covered by code</p>
              <p>Consultation etc.</p>
              <p>Period code is in force</p>
              <p>Note:	Paragraph 26C(2)(c) deals with the period during which the code is in force.</p>
              <p>Disallowance</p>
              <p>Note:	A registered APP code is a legislative instrument: see subsection 26B(2).</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-26GB__subclause-1">
              <num>1</num>
              <content>
                <p>	(1)	The Minister may, in writing, direct the Commissioner to develop an APP code (a <b><i>temporary APP code</i></b>) if the Minister<i> </i>is satisfied that:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26GB__para-a">
              <num>a</num>
              <content>
                <p>it is in the public interest:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GB__para-i">
              <num>i</num>
              <content>
                <p>to develop the code; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GB__para-ii">
              <num>ii</num>
              <content>
                <p>for <role refersTo="#commissioner">the Commissioner</role> to develop the code; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GB__para-b">
              <num>b</num>
              <content>
                <p>the code should be developed urgently.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26GB__subclause-2">
              <num>2</num>
              <content>
                <p>Without limiting subsection (1), a direction under that subsection may:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26GB__para-a">
              <num>a</num>
              <content>
                <p>specify one or more matters that the code must deal with; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GB__para-b">
              <num>b</num>
              <content>
                <p>specify the APP entities, or a class of APP entities, that should be bound by the code.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26GB__subclause-3">
              <num>3</num>
              <content>
                <p>A direction under subsection (1) is not a legislative instrument.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GB__subclause-4">
              <num>4</num>
              <content>
                <p><role refersTo="#commissioner">The Commissioner</role> must develop and register a temporary APP code if <role refersTo="#minister">the Minister</role> has given <role refersTo="#commissioner">the Commissioner</role> a direction under subsection (1) to develop the code.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GB__subclause-5">
              <num>5</num>
              <content>
                <p>However, despite paragraph 26C(3)(b), the temporary APP code must not cover an act or practice that is exempt <ref href="#sec-7B__subsec-1">within the meaning of subsection 7B(1)</ref>, (2) or (3).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GB__subclause-6">
              <num>6</num>
              <content>
                <p>In developing the temporary APP code, <role refersTo="#commissioner">the Commissioner</role> may consult any person <role refersTo="#commissioner">the Commissioner</role> considers appropriate.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GB__subclause-7">
              <num>7</num>
              <content>
                <p>The period set out for the temporary APP code for the purposes of paragraph 26C(2)(c) must not be longer than 12 months.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GB__subclause-8">
              <num>8</num>
              <content>
                <p>	(8)	Section 42 (disallowance) of the <i>Legislation Act 2003 </i>does not apply to a temporary APP code that is a registered APP code.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-6">
            <num>6</num>
            <heading>Paragraph 26H(1)(b)</heading>
            <content>
              <p>Omit “<ref href="#sec-26G">section 26G</ref>”, substitute “<ref href="#sec-26G">section 26G</ref>, 26GA or 26GB”.</p>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-7">
            <num>7</num>
            <heading>Subsection 80G(1)</heading>
            <content>
              <p>Insert:</p>
              <p><b><i>entity</i></b> includes the following:</p>
            </content>
            <paragraph eId="schedule-1__clause-7__para-a">
              <num>a</num>
              <content>
                <p>a person;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-7__para-b">
              <num>b</num>
              <content>
                <p>an agency;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-7__para-c">
              <num>c</num>
              <content>
                <p>an organisation.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-8">
            <num>8</num>
            <heading>Section 80H</heading>
            <content>
              <p>Repeal the section.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-9">
            <num>9</num>
            <heading>Subsections 80J(1) and (2)</heading>
            <content>
              <p>After “Minister may”, insert “, by writing,”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-10">
            <num>10</num>
            <heading>At the end of section 80J</heading>
            <content>
              <p>Add:</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-10__subclause-3">
              <num>3</num>
              <content>
                <p>	(3)	A declaration under this section is a legislative instrument, but <i>Legislation Act 2003 </i>does not apply to the declaration.<ref href="#sec-42">section 42</ref> (disallowance) of the </p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-11">
            <num>11</num>
            <heading>Subsection 80K(1)</heading>
            <content>
              <p>After “Minister may”, insert “, in writing,”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-12">
            <num>12</num>
            <heading>At the end of section 80K</heading>
            <content>
              <p>Add:</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-12__subclause-3">
              <num>3</num>
              <content>
                <p>	(3)	A declaration under this section is a legislative instrument, but <i>Legislation Act 2003 </i>does not apply to the declaration.<ref href="#sec-42">section 42</ref> (disallowance) of the </p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-13">
            <num>13</num>
            <heading>After section 80K</heading>
            <content>
              <p>Insert:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-80KA">
            <num>80KA</num>
            <heading>Matters covered by declarations</heading>
            <content>
              <p>Matters that must be specified</p>
              <p>Note:	See <ref href="#sec-80P">section 80P</ref> (authorisation of collection, use and disclosure of personal information).</p>
              <p>Specified entities</p>
              <p>Specified permitted purposes</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-80KA__subclause-1">
              <num>1</num>
              <content>
                <p>Without limiting <ref href="#sec-80J">section 80J</ref> or 80K, an emergency declaration must specify the following matters:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80KA__para-a">
              <num>a</num>
              <content>
                <p>the kind or kinds of personal information to which the declaration applies;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-b">
              <num>b</num>
              <content>
                <p>the entity or class of entities that may collect, use or disclose the personal information;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-c">
              <num>c</num>
              <content>
                <p>the entity or class of entities that the personal information may be disclosed to;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-d">
              <num>d</num>
              <content>
                <p>one or more permitted purposes of the collection, use or disclosure.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80KA__subclause-2">
              <num>2</num>
              <content>
                <p>An entity or class of entities specified for the purposes of paragraph (1)(c):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80KA__para-a">
              <num>a</num>
              <content>
                <p>may include a State or Territory authority; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-b">
              <num>b</num>
              <content>
                <p>must not be or include a media organisation, the Australian Broadcasting Corporation or the Special Broadcasting Service Corporation.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80KA__subclause-3">
              <num>3</num>
              <content>
                <p>A permitted purpose specified for the purposes of paragraph (1)(d) must be a purpose that directly relates to the Commonwealth’s response to an emergency or disaster in respect of which an emergency declaration is in force.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80KA__subclause-4">
              <num>4</num>
              <content>
                <p>Without limiting subsection (3), any of the following may be specified as a permitted purpose in relation to an emergency or disaster:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80KA__para-a">
              <num>a</num>
              <content>
                <p>identifying individuals who:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-i">
              <num>i</num>
              <content>
                <p>are or may be injured, missing or dead as a result of the emergency or disaster; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-ii">
              <num>ii</num>
              <content>
                <p>are or may be at risk of injury, going missing or death as a result of the emergency or disaster; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-iii">
              <num>iii</num>
              <content>
                <p>are or may be otherwise involved in or affected by the emergency or disaster; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-iv">
              <num>iv</num>
              <content>
                <p>are or may be at risk of otherwise being involved in or affected by the emergency or disaster;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-b">
              <num>b</num>
              <content>
                <p>assisting individuals involved in or affected by the emergency or disaster to obtain services such as repatriation services, medical or other treatment, health services and financial or other humanitarian assistance;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-c">
              <num>c</num>
              <content>
                <p>assisting individuals who are or may be at risk of being involved in or affected by the emergency or disaster to obtain services such as repatriation services, medical or other treatment, health services and financial or other humanitarian assistance;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-d">
              <num>d</num>
              <content>
                <p>assisting with law enforcement in relation to the emergency or disaster;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-e">
              <num>e</num>
              <content>
                <p>coordination or management of the response to the emergency or disaster;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-f">
              <num>f</num>
              <content>
                <p>ensuring that responsible persons for individuals who are, or may be, involved in the emergency or disaster are appropriately informed of matters that are relevant to:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-i">
              <num>i</num>
              <content>
                <p>the involvement of those individuals in the emergency or disaster; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-ii">
              <num>ii</num>
              <content>
                <p>the response to the emergency or disaster in relation to those individuals;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-g">
              <num>g</num>
              <content>
                <p>ensuring that responsible persons for individuals who are or may be at risk of being involved in or affected by the emergency or disaster are appropriately informed of matters that are relevant to:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-i">
              <num>i</num>
              <content>
                <p>the involvement of or effect on those individuals in the emergency or disaster; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-ii">
              <num>ii</num>
              <content>
                <p>the response to the emergency or disaster in relation to those individuals.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80KA__subclause-5">
              <num>5</num>
              <content>
                <p>	(5)	Without limiting subsection 33(3A) of the <i>Acts Interpretation Act 1901</i>, or any other provision of this Act, an emergency declaration may provide differently for:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80KA__para-a">
              <num>a</num>
              <content>
                <p>different kinds of personal information; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-b">
              <num>b</num>
              <content>
                <p>different entities or classes of entities; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80KA__para-c">
              <num>c</num>
              <content>
                <p>different permitted purposes.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-14">
            <num>14</num>
            <heading>Sections 80L and 80M</heading>
            <content>
              <p>Repeal the sections.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-15">
            <num>15</num>
            <heading>Section 80N (heading)</heading>
            <content>
              <p>Omit “<b>cease to have effect</b>”, substitute “<b>cease to be in force</b>”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-16">
            <num>16</num>
            <heading>Section 80N</heading>
            <content>
              <p>Omit “ceases to have effect at the earliest of”, substitute “ceases to be in force at the earliest of the following”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-17">
            <num>17</num>
            <heading>Paragraph 80N(a)</heading>
            <content>
              <p>Omit “cease to have effect”, substitute “cease to be in force”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-18">
            <num>18</num>
            <heading>Paragraph 80N(a)</heading>
            <content>
              <p>Omit “or”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-19">
            <num>19</num>
            <heading>Paragraph 80N(b)</heading>
            <content>
              <p>Omit “revoked; or”, substitute “repealed;”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-20">
            <num>20</num>
            <heading>Paragraph 80N(c)</heading>
            <content>
              <p>Repeal the paragraph, substitute:</p>
            </content>
            <paragraph eId="schedule-1__clause-20__para-c">
              <num>c</num>
              <content>
                <p>the start of the day after the end of the period of 12 months beginning on the day the declaration commences.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-21">
            <num>21</num>
            <heading>Paragraphs 80P(1)(b) to (e)</heading>
            <content>
              <p>Repeal the paragraphs, substitute:</p>
            </content>
            <paragraph eId="schedule-1__clause-21__para-b">
              <num>b</num>
              <content>
                <p>the collection, use or disclosure is for a permitted purpose specified in the declaration; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-21__para-c">
              <num>c</num>
              <content>
                <p>the information is information of a kind specified in the declaration; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-21__para-d">
              <num>d</num>
              <content>
                <p>the information is disclosed by an entity specified in the declaration, or an entity included in a class of entities specified in the declaration; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-21__para-e">
              <num>e</num>
              <content>
                <p>the information is disclosed to an entity specified in the declaration, or an entity included in a class of entities specified in the declaration; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-21__para-f">
              <num>f</num>
              <content>
                <p>if a matter mentioned in paragraph (b), (c), (d), or (e) is specified in the declaration subject to conditions—those conditions are satisfied.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-22">
            <num>22</num>
            <heading>Subsection 80P(7) (paragraph (a) of the definition of designated secrecy provision)</heading>
            <content>
              <p>After “18B,”, insert “34GF, 35P,”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-23">
            <num>23</num>
            <heading>Subsection 80P(7) (paragraph (a) of the definition of designated secrecy provision)</heading>
            <content>
              <p>After “92A”, insert “, and subsection 34GE(4),”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-24">
            <num>24</num>
            <heading>Subsection 80P(7) (after paragraph (a) of the definition of designated secrecy provision)</heading>
            <content>
              <p>Insert:</p>
            </content>
            <paragraph eId="schedule-1__clause-24__para-aa">
              <num>aa</num>
              <content>
                <p>	(aa)	<i>Crimes Act 1914</i>;<ref href="#sec-15L">section 15L</ref>C of the </p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-25">
            <num>25</num>
            <heading>Subsection 80P(7) (paragraph (c) of the definition of designated secrecy provision)</heading>
            <content>
              <p>Omit “and 41 of”, substitute “and 41 of, and clause 9 of Schedule 1 to,”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26">
            <num>26</num>
            <heading>Subsection 80P(7) (after paragraph (ca) of the definition of designated secrecy provision)</heading>
            <content>
              <p>Insert:</p>
            </content>
            <paragraph eId="schedule-1__clause-26__para-cb">
              <num>cb</num>
              <content>
                <p>	(cb)	sections 22, 22A and 22B of the <i>Witness Protection Act 1994</i>;</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-27">
            <num>27</num>
            <heading>Subsection 80P(7) (definition of entity)</heading>
            <content>
              <p>Repeal the definition.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-28">
            <num>28</num>
            <heading>After paragraph 80Q(2)(a)</heading>
            <content>
              <p>Insert:</p>
            </content>
            <paragraph eId="schedule-1__clause-28__para-b">
              <num>b</num>
              <content>
                <p>a disclosure for the purposes of carrying out a State’s constitutional functions, powers or duties;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-28__para-ba">
              <num>ba</num>
              <content>
                <p>a disclosure for the purposes of obtaining or providing legal advice in relation to the operation of this Part;</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-29">
            <num>29</num>
            <heading>Application of amendments</heading>
            <hcontainer name="subclause" eId="schedule-1__clause-29__subclause-1">
              <num>1</num>
              <content>
                <p>(1)	The amendments of sections 80J, 80K, 80N and 80P, the repeal of sections 80H, 80L and 80M, and the insertion of <i>Privacy Act 1988</i> made by this Part apply in relation to declarations made on or after the commencement of this item.<ref href="#sec-80K">section 80K</ref>A, of the </p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-29__subclause-2">
              <num>2</num>
              <content>
                <p>(2)	The amendments of <i>Privacy Act 1988</i> made by this Part apply in relation to the disclosure of information by a person on or after the commencement of this item, whether the information was first disclosed to that person before or after that commencement.<ref href="#sec-80Q">section 80Q</ref> of the </p>
              </content>
            </hcontainer>
            <content>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-30">
            <num>30</num>
            <heading>Subsection 6(1)</heading>
            <content>
              <p>Insert:</p>
              <p><b><i>child</i></b> means an individual who has not reached 18 years.</p>
              <p><b><i>Children’s Online Privacy Code</i></b>: see section 26GC.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-31">
            <num>31</num>
            <heading>After subsection 26C(4)</heading>
            <content>
              <p>Insert:</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-31__subclause-4A">
              <num>4A</num>
              <content>
                <p>	(4A)	Without limiting subsection 33(3A) of the <i>Acts Interpretation Act 1901</i>, an APP code may provide differently for different:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-31__para-a">
              <num>a</num>
              <content>
                <p>classes of entities; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-31__para-b">
              <num>b</num>
              <content>
                <p>classes of personal information; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-31__para-c">
              <num>c</num>
              <content>
                <p>classes of activities of entities.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-32">
            <num>32</num>
            <heading>Before section 26H</heading>
            <content>
              <p>Insert:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26GC">
            <num>26GC</num>
            <heading>Development of APP codes by the Commissioner—Children’s Online Privacy Code</heading>
            <content>
              <p>Children’s Online Privacy Code</p>
              <p>Note:	Section 26C deals with requirements for APP codes generally.</p>
              <p>Matters covered by code</p>
              <p>Note:	Codes may provide differently for different things: see subsection 26C(4A).</p>
              <p>Entities bound by code</p>
              <p>Note:	In relation to subparagraph (a)(ii), see subsection (11).</p>
              <p>Specified entities not bound by code</p>
              <p>Requirements</p>
              <p>Time by which code must be made</p>
              <p>Services likely to be accessed by children</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-1">
              <num>1</num>
              <content>
                <p>	(1)	The Commissioner must develop an APP code (the <b><i>Children’s Online Privacy Code</i></b>) about online privacy for children.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-2">
              <num>2</num>
              <content>
                <p>The other provisions of this Division (including <ref href="#sec-26C">section 26C</ref>) apply in relation to the Children’s Online Privacy Code subject to this section.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-3">
              <num>3</num>
              <content>
                <p>For the purposes of paragraph 26C(2)(a), the Children’s Online Privacy Code must set out how one or more of the Australian Privacy Principles are to be applied or complied with in relation to the privacy of children.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-4">
              <num>4</num>
              <content>
                <p>For the purposes of subsections 26C(3) and (4), the Children’s Online Privacy Code may provide for one or more of the matters mentioned in those subsections in relation to the privacy of children. However, despite paragraph 26C(3)(b), the code must not cover an act or practice that is exempt <ref href="#sec-7B__subsec-1">within the meaning of subsection 7B(1)</ref>, (2) or (3).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-5">
              <num>5</num>
              <content>
                <p>Subject to subsection (7), an APP entity is bound by the Children’s Online Privacy Code if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26GC__para-a">
              <num>a</num>
              <content>
                <p>all of the following apply:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-i">
              <num>i</num>
              <content>
                <p>	(i)	the entity is a provider of a social media service, relevant electronic service or designated internet service (all within the meaning of the <i>Online Safety Act 2021</i>);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-ii">
              <num>ii</num>
              <content>
                <p>the service is likely to be accessed by children;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-iii">
              <num>iii</num>
              <content>
                <p>the entity is not providing a health service; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-b">
              <num>b</num>
              <content>
                <p>the entity is an APP entity, or an APP entity in a class of entities, specified in the code for the purposes of this paragraph.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-6">
              <num>6</num>
              <content>
                <p>Paragraph 26C(2)(b) does not apply in relation to the Children’s Online Privacy Code.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-7">
              <num>7</num>
              <content>
                <p>Despite subsection (5), an APP entity is not bound by the Children’s Online Privacy Code if the entity is an APP entity, or an APP entity in a class of entities, specified in the code for the purposes of this subsection.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-8">
              <num>8</num>
              <content>
                <p>In developing the Children’s Online Privacy Code, <role refersTo="#commissioner">the Commissioner</role> may:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26GC__para-a">
              <num>a</num>
              <content>
                <p>consult with:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-i">
              <num>i</num>
              <content>
                <p>children; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-ii">
              <num>ii</num>
              <content>
                <p>relevant organisations or bodies concerned with children’s welfare; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-iia">
              <num>iia</num>
              <content>
                <p>industry organisations or bodies representing the interests of one or more entities that may potentially be bound by the Code;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-iii">
              <num>iii</num>
              <content>
                <p>the eSafety Commissioner; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-iv">
              <num>iv</num>
              <content>
                <p>the National Children’s Commissioner; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-b">
              <num>b</num>
              <content>
                <p>consult any other person <role refersTo="#commissioner">the Commissioner</role> considers appropriate.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-9">
              <num>9</num>
              <content>
                <p>Before registering the Children’s Online Privacy Code under <role refersTo="#commissioner">the Commissioner</role> must:<ref href="#sec-26H">section 26H</ref>, </p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26GC__para-a">
              <num>a</num>
              <content>
                <p>make a draft of the code publicly available; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-b">
              <num>b</num>
              <content>
                <p>invite the public to make submissions to <role refersTo="#commissioner">the Commissioner</role> about the draft within a specified period (which must run for at least 60 days); and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-c">
              <num>c</num>
              <content>
                <p>give consideration to any submissions made within the specified period; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-d">
              <num>d</num>
              <content>
                <p>consult with:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-i">
              <num>i</num>
              <content>
                <p>the eSafety Commissioner; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26GC__para-ii">
              <num>ii</num>
              <content>
                <p>the National Children’s Commissioner.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-10">
              <num>10</num>
              <content>
                <p>	(10)	The Commissioner must develop and register the Children’s Online Privacy Code within the period of 24 months beginning on the day the <i>Privacy and Other Legislation Amendment</i><i> Act 2024</i> receives the Royal Assent.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-11">
              <num>11</num>
              <content>
                <p><role refersTo="#commissioner">The Commissioner</role> may make written guidelines to assist entities to determine if a service is likely to be accessed by children for the purposes of subparagraph (5)(a)(ii).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-12">
              <num>12</num>
              <content>
                <p><role refersTo="#commissioner">The Commissioner</role> may publish any such guidelines on <role refersTo="#commissioner">the Commissioner</role>’s website.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26GC__subclause-13">
              <num>13</num>
              <content>
                <p>Guidelines under subsection (11) are not a legislative instrument.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-33">
            <num>33</num>
            <heading>After paragraph 26H(1)(b)</heading>
            <content>
              <p>Insert:</p>
              <p>; or (c)	<role refersTo="#commissioner">the Commissioner</role> develops a Children’s Online Privacy Code under section 26GC;</p>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-34">
            <num>34</num>
            <heading>At the end of clause 11 of Schedule 1</heading>
            <content>
              <p>Add:</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-34__subclause-11-3">
              <num>11.3</num>
              <content>
                <p>For the purposes of subclauses 11.1 and 11.2, without limiting those subclauses or any other provision of this Act, such steps include technical and organisational measures.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-35">
            <num>35</num>
            <heading>Application of amendment</heading>
            <content>
              <p>The amendment of clause 11 of Schedule 1 to the <i>Privacy Act 1988</i> made by this Part applies in relation to information held after the commencement of this Part, regardless of whether the information was acquired or created before or after that commencement.</p>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-36">
            <num>36</num>
            <heading>After subsection 100(1)</heading>
            <content>
              <p>Insert:</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-36__subclause-1A">
              <num>1A</num>
              <content>
                <p>Before the Governor-General makes regulations for the purposes of Australian Privacy Principle 8.3 prescribing a country or binding scheme, <role refersTo="#minister">the Minister</role> must be satisfied that:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-36__para-a">
              <num>a</num>
              <content>
                <p>the laws of the country, or the binding scheme, has the effect of protecting personal information about an individual in a way that, overall, is at least substantially similar to the way in which the Australian Privacy Principles protect the information; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-36__para-b">
              <num>b</num>
              <content>
                <p>there are mechanisms that the individual can access to take action to enforce that protection.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-36__subclause-1B">
              <num>1B</num>
              <content>
                <p>The regulations may prescribe a country or binding scheme for the purposes of Australian Privacy Principle 8.3 subject to:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-36__para-a">
              <num>a</num>
              <content>
                <p>conditions in relation to a specified entity or class of entities; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-36__para-b">
              <num>b</num>
              <content>
                <p>conditions in relation to a specified kind or kinds of personal information.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-37">
            <num>37</num>
            <heading>After paragraph 8.2(a) of Schedule 1</heading>
            <content>
              <p>Insert:</p>
            </content>
            <paragraph eId="schedule-1__clause-37__para-aa">
              <num>aa</num>
              <content>
                <p>subclause 8.3 applies in relation to the disclosure of the information; or</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-38">
            <num>38</num>
            <heading>At the end of clause 8 of Schedule 1 (after the note)</heading>
            <content>
              <p>Add:</p>
              <p>Note:	There are prerequisites that must be satisfied before the matters mentioned in this subclause are prescribed: see subsection 100(1A).</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-38__subclause-8-3">
              <num>8.3</num>
              <content>
                <p>This subclause applies in relation to the disclosure of personal information (the relevant personal information) about an individual by an APP entity to an overseas recipient if:</p>
              </content>
              <paragraph eId="schedule-1__clause-38__subclause-8-3__para-a">
                <num>a</num>
                <content>
                  <p>the recipient of the relevant personal information is:</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-38__subclause-8-3__para-i">
                <num>i</num>
                <content>
                  <p>subject to the laws of a country that is prescribed by the regulations; or</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-38__subclause-8-3__para-ii">
                <num>ii</num>
                <content>
                  <p>a participant in a binding scheme that is prescribed by the regulations; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-38__subclause-8-3__para-b">
                <num>b</num>
                <content>
                  <p>if the country or binding scheme is prescribed subject to conditions—those conditions are satisfied.</p>
                </content>
              </paragraph>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-39">
            <num>39</num>
            <heading>Application of amendments</heading>
            <content>
              <p>The amendments of clause 8 of Schedule 1 to the <i>Privacy Act 1988</i> made by this Part apply in relation to information disclosed after the commencement of this Part, regardless of whether the information was acquired or created before or after that commencement.</p>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-40">
            <num>40</num>
            <heading>Subsection 6(1)</heading>
            <content>
              <p>Insert:</p>
              <p><b><i>eligible data breach declaration</i></b> means a declaration under subsection 26X(1).</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-41">
            <num>41</num>
            <heading>Section 26WA (heading)</heading>
            <content>
              <p>Repeal the heading, substitute:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26WA">
            <num>26WA</num>
            <heading>Guide to this Part</heading>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-42">
            <num>42</num>
            <heading>At the end of section 26WA</heading>
            <content>
              <p>Add:</p>
              <p>•	This Part also deals with the collection, use and disclosure of personal information involved in eligible data breaches.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-43">
            <num>43</num>
            <heading>At the end of Part IIIC</heading>
            <content>
              <p>Add:</p>
              <p>Subdivision A—Eligible data breach declaration</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26X">
            <num>26X</num>
            <heading>Eligible data breach declaration</heading>
            <content>
              <p>Minister may make eligible data breach declaration</p>
              <p>a risk of harm arising from a misuse of personal information about one or more individuals following unauthorised access to, or unauthorised disclosure of, that personal information from the eligible data breach of the entity.</p>
              <p>Note:	A declaration under this subsection is relevant for the operation of <ref href="#sec-26X">section 26X</ref>B (authorisation of collection, use and disclosure of personal information) and related provisions.</p>
              <p>Matters covered by declaration</p>
              <p>Specified entities</p>
              <p>Specified permitted purposes</p>
              <p>Conditions</p>
              <p>Consultation</p>
              <p>Declaration is a legislative instrument</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-26X__subclause-1">
              <num>1</num>
              <content>
                <p><role refersTo="#minister">The Minister</role> may, by writing, make a declaration under this subsection if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26X__para-a">
              <num>a</num>
              <content>
                <p>there is an eligible data breach of an entity; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-b">
              <num>b</num>
              <content>
                <p><role refersTo="#minister">the Minister</role> is satisfied that making the declaration is:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-i">
              <num>i</num>
              <content>
                <p>necessary or appropriate to prevent; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-ii">
              <num>ii</num>
              <content>
                <p>necessary or appropriate to reduce;</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26X__subclause-2">
              <num>2</num>
              <content>
                <p>Without limiting subsection (1), the declaration must specify the following matters:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26X__para-a">
              <num>a</num>
              <content>
                <p>the kind or kinds of personal information to which the declaration applies;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-b">
              <num>b</num>
              <content>
                <p>the entity or class of entities that may collect, use or disclose the personal information;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-c">
              <num>c</num>
              <content>
                <p>the entity or class of entities that the personal information may be disclosed to;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-d">
              <num>d</num>
              <content>
                <p>one or more permitted purposes of the collection, use or disclosure.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26X__subclause-3">
              <num>3</num>
              <content>
                <p>An entity or class of entities specified for the purposes of paragraph (2)(c):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26X__para-a">
              <num>a</num>
              <content>
                <p>may include a State or Territory authority; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-b">
              <num>b</num>
              <content>
                <p>must not be or include a media organisation, the Australian Broadcasting Corporation or the Special Broadcasting Service Corporation.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26X__subclause-4">
              <num>4</num>
              <content>
                <p>A permitted purpose specified for the purposes of paragraph (2)(d) in relation to an eligible data breach must be a purpose that is directly related to preventing or reducing a risk of harm mentioned in paragraph (1)(b) to one or more individuals at risk from the eligible data breach.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26X__subclause-5">
              <num>5</num>
              <content>
                <p>Without limiting subsection (4), any of the following things may be specified as a permitted purpose in relation to an eligible data breach, to the extent that it is directly related to preventing or reducing a risk of harm mentioned in paragraph (1)(b):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26X__para-a">
              <num>a</num>
              <content>
                <p>	(a)	preventing a cyber security incident (within the meaning of the<i> Security of Critical Infrastructure Act 2018</i>), fraud, scam activity or identity theft;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-b">
              <num>b</num>
              <content>
                <p>responding to a cyber security incident, fraud, scam activity or identity theft;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-c">
              <num>c</num>
              <content>
                <p>responding to the consequences of a cyber security incident, fraud, scam activity, identity crime and misuse, financial loss, emotional and psychological harm, family violence and physical harm or intimidation;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-d">
              <num>d</num>
              <content>
                <p>addressing malicious cyber activity.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26X__subclause-6">
              <num>6</num>
              <content>
                <p>	(6)	Without limiting subsection 33(3A) of the <i>Acts Interpretation Act 1901</i>, or any other provision of this Act, an eligible data breach declaration may provide differently for:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26X__para-a">
              <num>a</num>
              <content>
                <p>different kinds of personal information; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-b">
              <num>b</num>
              <content>
                <p>different entities or classes of entities; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26X__para-c">
              <num>c</num>
              <content>
                <p>different permitted purposes.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26X__subclause-7">
              <num>7</num>
              <content>
                <p>The declaration may specify a matter mentioned in subsection (2) subject to conditions.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26X__subclause-8">
              <num>8</num>
              <content>
                <p>Before <role refersTo="#minister">the Minister</role> makes a declaration under subsection (1), <role refersTo="#minister">the Minister</role> may consult with any person or body, including <role refersTo="#commissioner">the Commissioner</role> and the Director-General of the Australian Signals Directorate.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26X__subclause-9">
              <num>9</num>
              <content>
                <p>	(9)	Despite subsection 29(1) of the <i>Australian Information Commissioner Act 2010</i> and any provision of this Act, the Commissioner may disclose information to the Minister for the purposes of consultation under subsection (8).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26X__subclause-10">
              <num>10</num>
              <content>
                <p>	(10)	A declaration under subsection (1) is a legislative instrument, but <i>Legislation Act 2003 </i>does not apply to the declaration.<ref href="#sec-42">section 42</ref> (disallowance) of the </p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26XA">
            <num>26XA</num>
            <heading>When declarations cease to be in force</heading>
            <content>
              <p>An eligible data breach declaration ceases to be in force at the earliest of the following:</p>
              <p>Subdivision B—Provisions dealing with the collection, use and disclosure of personal information</p>
            </content>
            <paragraph eId="schedule-1__clause-26XA__para-a">
              <num>a</num>
              <content>
                <p>if a time at which the declaration will cease to be in force is specified in the declaration—at that time;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XA__para-b">
              <num>b</num>
              <content>
                <p>the time at which the declaration is repealed;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XA__para-c">
              <num>c</num>
              <content>
                <p>the start of the day after the end of the period of 12 months beginning on the day the declaration commences.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26XB">
            <num>26XB</num>
            <heading>Authorisation of collection, use and disclosure of personal information</heading>
            <hcontainer name="subclause" eId="schedule-1__clause-26XB__subclause-1">
              <num>1</num>
              <content>
                <p>At any time when an eligible data breach declaration is in force in relation to an eligible data breach, an entity may collect, use or disclose personal information about an individual if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26XB__para-a">
              <num>a</num>
              <content>
                <p>the entity reasonably believes that the individual may be at risk from the eligible data breach; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-b">
              <num>b</num>
              <content>
                <p>the collection, use or disclosure is for a permitted purpose specified in the declaration; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-c">
              <num>c</num>
              <content>
                <p>the information is information of a kind or kinds specified in the declaration; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-d">
              <num>d</num>
              <content>
                <p>the information is disclosed by an entity specified in the declaration, or an entity included in a class of entities specified in the declaration; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-e">
              <num>e</num>
              <content>
                <p>the information is disclosed to an entity specified in the declaration, or an entity included in a class of entities specified in the declaration; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-f">
              <num>f</num>
              <content>
                <p>if a matter mentioned in paragraph (b), (c), (d) or (e) is specified in the declaration subject to conditions—those conditions are satisfied.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26XB__subclause-2">
              <num>2</num>
              <content>
                <p>An entity is not liable to any proceedings for contravening a secrecy provision in respect of a use or disclosure of personal information authorised by subsection (1) unless the secrecy provision is a designated secrecy provision (see subsection (6)).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XB__subclause-3">
              <num>3</num>
              <content>
                <p>An entity is not liable to any proceedings for contravening a duty of confidence in respect of a disclosure of personal information authorised by subsection (1).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XB__subclause-4">
              <num>4</num>
              <content>
                <p>An entity does not breach an Australian Privacy Principle, a registered APP code that binds the entity or a rule issued under <ref href="#sec-17">section 17</ref> (rules relating to tax file number information) in respect of a collection, use or disclosure of personal information authorised by subsection (1).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XB__subclause-5">
              <num>5</num>
              <content>
                <p>A collection, use or disclose of personal information by an officer or employee of an agency in the course of duty as an officer or employee is authorised by subsection (1) only if the officer or employee is authorised by the agency to collect, use or disclose the personal information.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XB__subclause-6">
              <num>6</num>
              <content>
                <p>In this section:</p>
              </content>
            </hcontainer>
            <content>
              <p><b><i>designated secrecy provision</i></b> means any of the following:</p>
              <p><b><i>secrecy provision</i></b> means a provision of a Commonwealth law (including a provision of this Act) that prohibits or regulates the use or disclosure of personal information, whether the provision relates to the use or disclosure of personal information generally or in specified circumstances.</p>
              <p>Subdivision C—Other matters</p>
            </content>
            <paragraph eId="schedule-1__clause-26XB__para-a">
              <num>a</num>
              <content>
                <p>	(a)	sections 18, 18A, 18B, 34GF, 35P, 92 and 92A, and subsection 34GE(4), of the <i>Australian Security Intelligence Organisation Act 1979</i>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-b">
              <num>b</num>
              <content>
                <p>	(b)	<i>Crimes Act 1914</i>;<ref href="#sec-15L">section 15L</ref>C of the </p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-c">
              <num>c</num>
              <content>
                <p>	(c)	<i>Inspector</i><i>-</i><i>General of Intelligence and Security Act 1986</i>;<ref href="#sec-34">section 34</ref> of the </p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-d">
              <num>d</num>
              <content>
                <p>	(d)	sections 39, 40C, 40D and 41 of, and clause 9 of Schedule 1 to, the <i>Intelligence Services Act 2001</i>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-e">
              <num>e</num>
              <content>
                <p>	(e)	sections 42 and 44 of the <i>Office of National Intelligence Act 2018</i>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-f">
              <num>f</num>
              <content>
                <p>	(f)	sections 22, 22A and 22B of the <i>Witness Protection Act 1994</i>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-g">
              <num>g</num>
              <content>
                <p>a provision of a Commonwealth law prescribed by the regulations for the purposes of this paragraph;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XB__para-h">
              <num>h</num>
              <content>
                <p>a provision of a Commonwealth law of a kind prescribed by the regulations for the purposes of this paragraph.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26XC">
            <num>26XC</num>
            <heading>Disclosure of information—offence</heading>
            <hcontainer name="subclause" eId="schedule-1__clause-26XC__subclause-1">
              <num>1</num>
              <content>
                <p>	(1)	A person (the <b><i>first person</i></b>) commits an offence if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26XC__para-a">
              <num>a</num>
              <content>
                <p>personal information that relates to an individual is disclosed to the first person because of the operation of this Division; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XC__para-b">
              <num>b</num>
              <content>
                <p>the first person subsequently discloses the personal information.</p>
              </content>
            </paragraph>
            <content>
              <p>Penalty:	<quantity refersTo="#penaltyUnit">60 penalty units</quantity> or <quantity refersTo="#custodialSentence">imprisonment for 1 year</quantity>, or both.</p>
              <p>Note:	A defendant bears an evidential burden in relation to a matter in this subsection (see subsection 13.3(3) of the <i>Criminal Code</i>).</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-26XC__subclause-2">
              <num>2</num>
              <content>
                <p>Subsection (1) does not apply to the following disclosures:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26XC__para-a">
              <num>a</num>
              <content>
                <p>if the first person is an APP entity—a disclosure permitted under an Australian Privacy Principle, a registered APP code that binds the person or a rule issued under <ref href="#sec-17">section 17</ref> (rules relating to tax file number information);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XC__para-b">
              <num>b</num>
              <content>
                <p>a disclosure for the purposes of carrying out a State’s constitutional functions, powers or duties;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XC__para-c">
              <num>c</num>
              <content>
                <p>a disclosure for the purposes of obtaining or providing legal advice in relation to the operation of this Division;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XC__para-d">
              <num>d</num>
              <content>
                <p>a disclosure permitted under <ref href="#sec-26X">section 26X</ref>B;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XC__para-e">
              <num>e</num>
              <content>
                <p>a disclosure made with the consent of the individual to whom the personal information relates;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XC__para-f">
              <num>f</num>
              <content>
                <p>a disclosure to the individual to whom the personal information relates;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XC__para-g">
              <num>g</num>
              <content>
                <p>a disclosure to a court;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XC__para-h">
              <num>h</num>
              <content>
                <p>a disclosure prescribed by the regulations.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26XC__subclause-3">
              <num>3</num>
              <content>
                <p>If a disclosure of personal information is covered by subsection (2), the disclosure is authorised by this section.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XC__subclause-4">
              <num>4</num>
              <content>
                <p>For the purposes of paragraph (2)(g), court includes any tribunal, authority or person having power to require the production of documents or the answering of questions.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26XD">
            <num>26XD</num>
            <heading>Division not limited by secrecy provisions</heading>
            <hcontainer name="subclause" eId="schedule-1__clause-26XD__subclause-1">
              <num>1</num>
              <content>
                <p>The operation of this Division is not limited by a secrecy provision of any other Commonwealth law (whether made before or after the commencement of this Act) except to the extent that the secrecy provision expressly excludes the operation of this section.</p>
              </content>
            </hcontainer>
            <content>
              <p>Note:	Section 3 provides for the concurrent operation of State and Territory laws.</p>
              <p><b><i>secrecy provision</i></b> means a provision of a Commonwealth law (including a provision of this Act) that prohibits or regulates the use or disclosure of personal information, whether the provision relates to the use or disclosure of personal information generally or in specified circumstances.</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-26XD__subclause-2">
              <num>2</num>
              <content>
                <p>Nothing in this Division is to be taken to require an entity to collect, use or disclose personal information.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XD__subclause-3">
              <num>3</num>
              <content>
                <p>In this section:</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26XE">
            <num>26XE</num>
            <heading>Constitutional basis of this Division</heading>
            <content>
              <p>This Division relies on the Commonwealth’s legislative powers under paragraph 51(xxix) (external affairs) of the Constitution as it relates to giving effect to Australia’s obligations under relevant international agreements, in particular Article 17 of the International Covenant on Civil and Political Rights done at New York on <date date="1966-12-16">16 December 1966</date> ([1980] ATS 23).</p>
              <p>Note:	The Covenant is in Australian Treaty Series 1980 No. 23 ([1980] ATS 23) and could in 2024 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26XF">
            <num>26XF</num>
            <heading>Additional operation of this Division</heading>
            <hcontainer name="subclause" eId="schedule-1__clause-26XF__subclause-1">
              <num>1</num>
              <content>
                <p>In addition to <ref href="#sec-26X">section 26X</ref>E, this Division also has effect as provided by this section.</p>
              </content>
            </hcontainer>
            <content>
              <p>Corporations</p>
              <p>Banking</p>
              <p>Insurance</p>
              <p>Trade and commerce</p>
              <p>Communications</p>
              <p>Territories</p>
              <p>Aliens</p>
              <p>External affairs</p>
              <p>Executive power</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-26XF__subclause-2">
              <num>2</num>
              <content>
                <p>This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure by a corporation to which paragraph 51(xx) of the Constitution applies.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XF__subclause-3">
              <num>3</num>
              <content>
                <p>This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure that occurs in the course of, or in relation to, the carrying on of the business of banking (within the meaning of paragraph 51(xiii) of the Constitution), other than State banking not extending beyond the limits of the State concerned.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XF__subclause-4">
              <num>4</num>
              <content>
                <p>This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure that occurs in the course of, or in relation to, the carrying on of the business of insurance (within the meaning of paragraph 51(xiv) of the Constitution), other than State insurance not extending beyond the limits of the State concerned.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XF__subclause-5">
              <num>5</num>
              <content>
                <p>This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure that occurs in the course of, or in relation to, trade or commerce:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26XF__para-a">
              <num>a</num>
              <content>
                <p>between Australia and places outside Australia; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XF__para-b">
              <num>b</num>
              <content>
                <p>among the States; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XF__para-c">
              <num>c</num>
              <content>
                <p>within a Territory, between a State and a Territory or between 2 Territories.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26XF__subclause-6">
              <num>6</num>
              <content>
                <p>This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure using a postal, telegraphic, telephonic or other like service (within the meaning of paragraph 51(v) of the Constitution).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XF__subclause-7">
              <num>7</num>
              <content>
                <p>This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure taking place in a Territory.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XF__subclause-8">
              <num>8</num>
              <content>
                <p>This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-26XF__para-a">
              <num>a</num>
              <content>
                <p>a collection, use or disclosure by an alien (within the meaning of paragraph 51(xix) of the Constitution); or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-26XF__para-b">
              <num>b</num>
              <content>
                <p>a collection, use or disclosure of personal information about an alien (within the meaning of paragraph 51(xix) of the Constitution).</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-26XF__subclause-9">
              <num>9</num>
              <content>
                <p>This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure taking place outside Australia.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XF__subclause-10">
              <num>10</num>
              <content>
                <p>	(10)	This Division also has the effect it would have if a reference to a collection, use or disclosure were expressly confined to a collection, use or disclosure by a Commonwealth entity (within the meaning of the <i>Public Governance, Performance and Accountability Act 2013</i>) for the purposes of the Commonwealth entity performing its functions or duties or exercising its powers.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26XG">
            <num>26XG</num>
            <heading>Interaction with section 12B</heading>
            <content>
              <p>To avoid doubt, <ref href="#sec-12B">section 12B</ref> does not apply in relation to this Division.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-26XH">
            <num>26XH</num>
            <heading>Compensation for acquisition of property</heading>
            <hcontainer name="subclause" eId="schedule-1__clause-26XH__subclause-1">
              <num>1</num>
              <content>
                <p>If the operation of this Division would result in an acquisition of property (within the meaning of paragraph 51(xxxi) of the Constitution) from a person otherwise than on just terms (within the meaning of that paragraph), the Commonwealth is liable to pay a reasonable amount of compensation to the person.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-26XH__subclause-2">
              <num>2</num>
              <content>
                <p>If the Commonwealth and the person do not agree on the amount of the compensation, the person may institute proceedings in the Federal Court of Australia or the Supreme Court of a State or Territory for the recovery from the Commonwealth of such reasonable amount of compensation as the court determines.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-44">
            <num>44</num>
            <heading>Application provision</heading>
            <content>
              <p>	<i> Privacy Act 1988</i>, as inserted by this Part, applies in relation to:<ref href="#dvs-5">Division 5</ref> of <ref href="#part-III">Part III</ref>C of the</p>
              <p>Data Availability and Transparency Act 2022</p>
            </content>
            <paragraph eId="schedule-1__clause-44__para-a">
              <num>a</num>
              <content>
                <p>eligible data breaches that happen on or after the commencement of this Part; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-44__para-b">
              <num>b</num>
              <content>
                <p>information collected, used or disclosed after the commencement of this Part, regardless of whether the information was acquired or created before or after that commencement.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-45">
            <num>45</num>
            <heading>Paragraph 16F(1)(b)</heading>
            <content>
              <p>Omit “sections 13 and 13G”, substitute “sections 13, 13G and 13H”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-46">
            <num>46</num>
            <heading>Subsection 16F(3)</heading>
            <content>
              <p>Omit “<ref href="#sec-13G">section 13G</ref>”, substitute “sections 13G and 13H”.</p>
              <p>Digital ID Act 2024</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-47">
            <num>47</num>
            <heading>Paragraphs 37(2)(b) and 38(1)(b)</heading>
            <content>
              <p>Omit “sections 13 and 13G”, substitute “sections 13, 13G and 13H”.</p>
              <p>Identity Verification Services Act 2023</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-48">
            <num>48</num>
            <heading>Paragraph 10A(2)(b)</heading>
            <content>
              <p>Omit “sections 13 and 13G”, substitute “sections 13, 13G and 13H”.</p>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-49">
            <num>49</num>
            <heading>Section 13G (heading)</heading>
            <content>
              <p>Repeal the heading, substitute:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-13G">
            <num>13G</num>
            <heading>Civil penalty provision for serious interference with privacy of an individual</heading>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-50">
            <num>50</num>
            <heading>Subsection 13G(1)</heading>
            <content>
              <p>Repeal the subsection, substitute:</p>
              <p>Civil penalty provision</p>
              <p>Note:	The court may determine that an entity has contravened <ref href="#sec-13H">section 13H</ref> if the court is satisfied of paragraph (a) but not paragraph (b) (see <ref href="#sec-13J">section 13J</ref>).</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-50__subclause-1">
              <num>1</num>
              <content>
                <p>An entity contravenes this subsection if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-50__para-a">
              <num>a</num>
              <content>
                <p>the entity does an act, or engages in a practice, that is an interference with the privacy of an individual; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-50__para-b">
              <num>b</num>
              <content>
                <p>the interference with privacy is serious.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-51">
            <num>51</num>
            <heading>After subsection 13G(1A)</heading>
            <content>
              <p>Insert:</p>
              <p>Factors that may be taken into account in determining if interference with privacy is serious</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-51__subclause-1B">
              <num>1B</num>
              <content>
                <p>In determining whether an interference with privacy is serious, a court may have regard to any of the following matters:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-51__para-a">
              <num>a</num>
              <content>
                <p>the particular kind or kinds of information involved in the interference with privacy;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-51__para-b">
              <num>b</num>
              <content>
                <p>the sensitivity of the personal information of the individual;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-51__para-c">
              <num>c</num>
              <content>
                <p>the consequences, or potential consequences, of the interference with privacy for the individual;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-51__para-d">
              <num>d</num>
              <content>
                <p>the number of individuals affected by the interference with privacy;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-51__para-e">
              <num>e</num>
              <content>
                <p>whether the individual affected by the interference with privacy is a child or person experiencing vulnerability;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-51__para-f">
              <num>f</num>
              <content>
                <p>whether the act was done, or the practice engaged in, repeatedly or continuously;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-51__para-g">
              <num>g</num>
              <content>
                <p>whether the contravening entity failed to take steps to implement practices, procedures and systems to comply with their obligations in relation to privacy in a way that contributed to the interference with privacy;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-51__para-h">
              <num>h</num>
              <content>
                <p>any other relevant matter.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-52">
            <num>52</num>
            <heading>Before subsection 13G(2)</heading>
            <content>
              <p>Insert:</p>
              <p>Maximum pecuniary penalty</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-53">
            <num>53</num>
            <heading>Subsection 13G(3)</heading>
            <content>
              <p>Omit “greater”, substitute “greatest”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-54">
            <num>54</num>
            <heading>Before subsection 13G(5)</heading>
            <content>
              <p>Insert:</p>
              <p>Meaning of adjusted turnover</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-55">
            <num>55</num>
            <heading>Before subsection 13G(7)</heading>
            <content>
              <p>Insert:</p>
              <p>Meaning of breach turnover period</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-56">
            <num>56</num>
            <heading>At the end of Division 1 of Part III</heading>
            <content>
              <p>Add:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-13H">
            <num>13H</num>
            <heading>Civil penalty provision for interference with privacy of individuals</heading>
            <content>
              <p>Civil penalty provision</p>
              <p>Note:	Section 80U deals with civil penalty provisions in this Act.</p>
              <p>Maximum pecuniary penalty</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-13H__subclause-1">
              <num>1</num>
              <content>
                <p>An entity contravenes this subsection if the entity does an act, or engages in a practice, that is an interference with the privacy of an individual.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-13H__subclause-2">
              <num>2</num>
              <content>
                <p>Subsection (1) is a civil penalty provision.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-13H__subclause-3">
              <num>3</num>
              <content>
                <p>The amount of the penalty payable by a person in respect of a contravention of subsection (1) must not exceed <quantity refersTo="#penaltyUnit">2,000 penalty units</quantity>.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-13J">
            <num>13J</num>
            <heading>Alternative orders</heading>
            <content>
              <p>If, in proceedings for an order in relation to a contravention of <ref href="#sec-13G">section 13G</ref>, the court:</p>
              <p>the court may make a pecuniary penalty order against the entity for contravening <ref href="#sec-13H">section 13H</ref>, instead of <ref href="#sec-13G">section 13G</ref>.</p>
            </content>
            <paragraph eId="schedule-1__clause-13J__para-a">
              <num>a</num>
              <content>
                <p>is satisfied that the entity has done an act, or engaged in a practice, that is an interference with the privacy of an individual; but</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13J__para-b">
              <num>b</num>
              <content>
                <p>is not satisfied that the interference with privacy is serious;</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-13K">
            <num>13K</num>
            <heading>Civil penalty provision for which infringement notices or compliance notices can be issued</heading>
            <content>
              <p>Civil penalty provision for breaching Australian Privacy Principles</p>
              <p>Note:	Conduct that contravenes this section may also contravene <ref href="#sec-13G">section 13G</ref> or 13H.</p>
              <p>Civil penalty provision for non-compliant eligible data breach statement</p>
              <p>Civil penalty provisions</p>
              <p>Note:	Section 80U deals with civil penalty provisions in this Act.</p>
              <p>Maximum pecuniary penalty</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-13K__subclause-1">
              <num>1</num>
              <content>
                <p>An entity contravenes this subsection if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-13K__para-a">
              <num>a</num>
              <content>
                <p>the entity does an act, or engages in a practice; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-b">
              <num>b</num>
              <content>
                <p>the act or practice breaches any of the following Australian Privacy Principles:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-i">
              <num>i</num>
              <content>
                <p>Australian Privacy Principle 1.3 (requirement to have APP privacy policy);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-ii">
              <num>ii</num>
              <content>
                <p>Australian Privacy Principle 1.4 (contents of APP privacy policy);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-iii">
              <num>iii</num>
              <content>
                <p>Australian Privacy Principle 2.1 (individuals may choose not to identify themselves in dealing with entities);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-iv">
              <num>iv</num>
              <content>
                <p>Australian Privacy Principle 6.5 (written notice of certain uses or disclosures);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-v">
              <num>v</num>
              <content>
                <p>Australian Privacy Principle 7.2(c) or 7.3(c) (simple means for individuals to opt out of direct marketing communications);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-vi">
              <num>vi</num>
              <content>
                <p>Australian Privacy Principle 7.3(d) (requirement to draw attention to ability to opt out of direct marketing communications);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-vii">
              <num>vii</num>
              <content>
                <p>Australian Privacy Principle 7.7(a) (giving effect to request in reasonable period);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-viii">
              <num>viii</num>
              <content>
                <p>Australian Privacy Principle 7.7(b) (notification of source of information);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-ix">
              <num>ix</num>
              <content>
                <p>Australian Privacy Principle 13.5 (dealing with requests);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-x">
              <num>x</num>
              <content>
                <p>any other Australian Privacy Principle prescribed by the regulations.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-13K__subclause-2">
              <num>2</num>
              <content>
                <p>An entity contravenes this subsection if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-13K__para-a">
              <num>a</num>
              <content>
                <p>the entity prepares a statement under <ref href="#sec-26W">section 26W</ref>K (eligible data breaches); and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-13K__para-b">
              <num>b</num>
              <content>
                <p>the statement does not comply with subsection 26WK(3).</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-13K__subclause-3">
              <num>3</num>
              <content>
                <p>Subsections (1) and (2) are civil penalty provisions.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-13K__subclause-4">
              <num>4</num>
              <content>
                <p>The amount of the penalty payable by a person in respect of a contravention of subsection (1) or (2) must not exceed <quantity refersTo="#penaltyUnit">200 penalty units</quantity>.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-57">
            <num>57</num>
            <heading>Subsection 80UB(1)</heading>
            <content>
              <p>Repeal the subsection, substitute:</p>
              <p>Provisions subject to an infringement notice</p>
              <p>Note:	Part 5 of the Regulatory Powers Act creates a framework for using infringement notices in relation to provisions.</p>
              <p>Amount to be stated in an infringement notice for listed companies—<ref href="#sec-13K">section 13K</ref></p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-57__subclause-1">
              <num>1</num>
              <content>
                <p>The following provisions are subject to an infringement notice under Part 5 of the Regulatory Powers Act:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-57__para-a">
              <num>a</num>
              <content>
                <p>subsections 13K(1) and (2) (civil penalty provision for which infringement notices or compliance notices can be issued);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-57__para-b">
              <num>b</num>
              <content>
                <p>subsection 66(1) (failure to give information);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-57__para-c">
              <num>c</num>
              <content>
                <p>subsection 80UC(4) (failure to comply with a compliance notice).</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-57__subclause-1A">
              <num>1A</num>
              <content>
                <p>	(1A)	Despite subsection 104(2) of the Regulatory Powers Act, if an infringement notice relates to only one alleged contravention of subsection 13K(1) or (2), or 80UC(4), by a listed corporation (within the meaning of the <i>Corporations Act 2001</i>), the amount to be stated in the notice for the purposes of paragraph 104(1)(f) of the Regulatory Powers Act is 200 penalty units.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-57__subclause-1B">
              <num>1B</num>
              <content>
                <p>	(1B)	Despite subsection 104(3) of the Regulatory Powers Act, if an infringement notice relates to more than one alleged contravention of subsection 13K(1) or (2), or 80UC(4), by a listed corporation (within the meaning of the <i>Corporations Act 2001</i>), the amount to be stated in the notice for the purposes of paragraph 104(1)(f) of the Regulatory Powers Act is the number of penalty units worked out by multiplying the number of alleged contraventions by 200.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-57A">
            <num>57A</num>
            <heading>After Division 1A of Part VIB</heading>
            <content>
              <p>Insert:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-80UC">
            <num>80UC</num>
            <heading>Compliance notices</heading>
            <content>
              <p>Giving a compliance notice</p>
              <p>Note:	The notice may be varied or revoked under subsection 33(3) of the <i>Acts Interpretation Act 1901</i>.</p>
              <p>Entity must comply with compliance notice</p>
              <p>Note:	Section 80U deals with civil penalty provisions in this Act.</p>
              <p>Effect of complying with a compliance notice</p>
              <p>Relationship with civil penalty provisions</p>
              <p>Relationship with infringement notices</p>
              <p>Relationship with enforceable undertakings</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-1">
              <num>1</num>
              <content>
                <p>Any of the following persons may give an entity a notice if the person reasonably believes that the entity has contravened subsection 13K(1) or (2) (civil penalty provision for which infringement notices or compliance notices can be issued):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80UC__para-a">
              <num>a</num>
              <content>
                <p><role refersTo="#commissioner">the Commissioner</role>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-b">
              <num>b</num>
              <content>
                <p>a member of the staff of <role refersTo="#commissioner">the Commissioner</role> who holds, or is acting in, an office or position that is equivalent to an SES employee.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-2">
              <num>2</num>
              <content>
                <p>The notice must:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80UC__para-a">
              <num>a</num>
              <content>
                <p>set out the name of the entity to whom the notice is given; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-b">
              <num>b</num>
              <content>
                <p>set out details of the contravention; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-c">
              <num>c</num>
              <content>
                <p>specify either or both of the following:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-i">
              <num>i</num>
              <content>
                <p>action the entity must take, or refrain from taking, within a reasonable period specified in the notice, to address the contravention;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-ii">
              <num>ii</num>
              <content>
                <p>steps the entity must take, within a reasonable period specified in the notice, to ensure that the conduct constituting the contravention is not repeated or continued; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-d">
              <num>d</num>
              <content>
                <p>explain that a failure to comply with the notice may contravene a civil penalty provision; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-e">
              <num>e</num>
              <content>
                <p>explain that the entity may apply to the Federal Court or the Federal Circuit and Family Court of Australia (<ref href="#dvs-2">Division 2</ref>) for a review of the notice on either or both of the following grounds:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-i">
              <num>i</num>
              <content>
                <p>the entity has not committed the contravention set out in the notice;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-ii">
              <num>ii</num>
              <content>
                <p>the notice does not comply with this subsection.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-3">
              <num>3</num>
              <content>
                <p>The notice may also require the entity to produce, within a reasonable period specified in the notice, reasonable evidence of compliance with the notice.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-4">
              <num>4</num>
              <content>
                <p>An entity contravenes this subsection if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80UC__para-a">
              <num>a</num>
              <content>
                <p>the entity is given a notice under subsection (1); and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-b">
              <num>b</num>
              <content>
                <p>the entity fails to comply with the notice.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-5">
              <num>5</num>
              <content>
                <p>Subsection (4) is a civil penalty provision.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-6">
              <num>6</num>
              <content>
                <p>The amount of the penalty payable by a person in respect of a contravention of subsection (4) must not exceed <quantity refersTo="#penaltyUnit">200 penalty units</quantity>.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-7">
              <num>7</num>
              <content>
                <p>An entity that complies with a notice given under subsection (1) in relation to a contravention of subsection 13K(1) or (2) is not taken by that compliance:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80UC__para-a">
              <num>a</num>
              <content>
                <p>to have admitted to contravening that subsection; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-b">
              <num>b</num>
              <content>
                <p>to have been found to have contravened that subsection.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-8">
              <num>8</num>
              <content>
                <p><role refersTo="#commissioner">The Commissioner</role> must not apply for an order under Part 4 of the Regulatory Powers Act in relation to a contravention of subsection 13G(1), 13H(1) or 13K(1) or (2) of this Act constituted by particular conduct engaged in by an entity, if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80UC__para-a">
              <num>a</num>
              <content>
                <p>the entity has been given a notice under subsection (1) of this section in relation to a contravention constituted by the same conduct; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-b">
              <num>b</num>
              <content>
                <p>either of the following subparagraphs applies:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-i">
              <num>i</num>
              <content>
                <p>the notice has not been withdrawn, and the entity has complied with the notice;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-ii">
              <num>ii</num>
              <content>
                <p>the entity has made an application under <ref href="#sec-80U">section 80U</ref>D of this Act in relation to the notice and the application has not been completely dealt with.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-9">
              <num>9</num>
              <content>
                <p>A notice must not be given under subsection (1) to an entity in relation to a contravention if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80UC__para-a">
              <num>a</num>
              <content>
                <p>the entity has been given an infringement notice under Part 5 of the Regulatory Powers Act in relation to the contravention; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-b">
              <num>b</num>
              <content>
                <p>the infringement notice has not been withdrawn.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-10">
              <num>10</num>
              <content>
                <p>An infringement notice must not be given to an entity under Part 5 of the Regulatory Powers Act in relation to a contravention of subsection 13K(1) or (2) of this Act if the entity has been given a notice under subsection (1) of this section, in relation to the contravention, that has not been withdrawn or cancelled.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80UC__subclause-11">
              <num>11</num>
              <content>
                <p>A notice must not be given under subsection (1) to an entity in relation to a contravention if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80UC__para-a">
              <num>a</num>
              <content>
                <p><role refersTo="#commissioner">the Commissioner</role> has accepted an undertaking from the entity under Part 6 of the Regulatory Powers Act in relation to the contravention; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UC__para-b">
              <num>b</num>
              <content>
                <p>the undertaking has not been withdrawn or cancelled.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-80UD">
            <num>80UD</num>
            <heading>Review of compliance notices</heading>
            <hcontainer name="subclause" eId="schedule-1__clause-80UD__subclause-1">
              <num>1</num>
              <content>
                <p>An entity that has been given a notice under subsection 80UC(1) may apply to the Federal Court or the Federal Circuit and Family Court of Australia (<ref href="#dvs-2">Division 2</ref>) for a review of the notice on either or both of the following grounds:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80UD__para-a">
              <num>a</num>
              <content>
                <p>the entity has not committed the contravention set out in the notice;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UD__para-b">
              <num>b</num>
              <content>
                <p>the notice does not comply with subsection 80UC(2).</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80UD__subclause-2">
              <num>2</num>
              <content>
                <p>At any time after the application has been made, the court may stay the operation of the notice on the terms and conditions that the court considers appropriate.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80UD__subclause-3">
              <num>3</num>
              <content>
                <p>The court may confirm, cancel or vary the notice after reviewing it.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-58">
            <num>58</num>
            <heading>Application of amendments</heading>
            <hcontainer name="subclause" eId="schedule-1__clause-58__subclause-1">
              <num>1</num>
              <content>
                <p>(1)	The amendments of <i>Privacy Act 1988</i> made by this Part<i> </i>apply in relation to acts done, or practices engaged in, after the commencement of this item.<ref href="#sec-13G">section 13G</ref> of the </p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-58__subclause-2">
              <num>2</num>
              <content>
                <p>(2)	Sections 13H, 13J, 13K, 80UC and 80UD of the <i>Privacy Act 1988</i>, as inserted by this Part, and the amendments of section 80UB of the <i>Privacy Act 1988</i> made by this Part, apply in relation to acts done, or practices engaged in, after the commencement of this item.</p>
              </content>
            </hcontainer>
            <content>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-59">
            <num>59</num>
            <heading>At the end of Division 1 of Part VIB</heading>
            <content>
              <p>Add:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-80UA">
            <num>80UA</num>
            <heading>Powers of court to make other orders</heading>
            <hcontainer name="subclause" eId="schedule-1__clause-80UA__subclause-1">
              <num>1</num>
              <content>
                <p>The Federal Court, or the Federal Circuit and Family Court of Australia (<ref href="#dvs-2">Division 2</ref>), may make an order under this section in proceedings if, in the proceedings, the Court has determined, or will determine, under the Regulatory Powers Act that an entity has contravened a civil penalty provision of this Act (other than <ref href="#part-IIIA">Part IIIA</ref>).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80UA__subclause-2">
              <num>2</num>
              <content>
                <p>Without limiting subsection (1), examples of orders the Court may make under this section include the following:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80UA__para-a">
              <num>a</num>
              <content>
                <p>an order directing the entity to perform any reasonable act, or carry out any reasonable course of conduct, to redress the loss or damage suffered, or likely to be suffered, by any individual as a result of the contravention;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UA__para-b">
              <num>b</num>
              <content>
                <p>an order directing the entity to pay damages to any individual by way of compensation for any loss or damage suffered, or likely to be suffered, by any individual as a result of the contravention;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UA__para-c">
              <num>c</num>
              <content>
                <p>an order directing the entity to engage, or not to engage, in any act or practice to avoid repeating or continuing the contravention;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UA__para-d">
              <num>d</num>
              <content>
                <p>an order directing the entity to publish, or otherwise communicate, a statement about the contravention.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80UA__subclause-3">
              <num>3</num>
              <content>
                <p>The Court may make an order under subsection (1) whether or not the Court is to make, or has made, a civil penalty order under subsection 82(3) of the Regulatory Powers Act against the entity in relation to the contravention.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80UA__subclause-4">
              <num>4</num>
              <content>
                <p>The Court may exercise the power under subsection (1):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80UA__para-a">
              <num>a</num>
              <content>
                <p>on its own initiative, during proceedings before the Court; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UA__para-b">
              <num>b</num>
              <content>
                <p>on application, made within the period of 6 years of the contravention, by either of the following persons:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UA__para-i">
              <num>i</num>
              <content>
                <p>an individual who has suffered, or is likely to suffer, loss or damage as a result of the contravention;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80UA__para-ii">
              <num>ii</num>
              <content>
                <p><role refersTo="#commissioner">the Commissioner</role>.</p>
              </content>
            </paragraph>
            <content>
              <p>Recovery of compensation as a debt</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-80UA__subclause-5">
              <num>5</num>
              <content>
                <p>If the Court makes an order that the entity pay an amount to an individual, the individual may recover the amount as a debt due to the individual.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-60">
            <num>60</num>
            <heading>Application of amendments</heading>
            <content>
              <p>Section 80UA of the <i>Privacy Act 1988</i>, as inserted by this Part, applies in relation to proceedings instituted after the commencement of this Part, whether the contravention to which the proceedings relate is alleged to have occurred before, on or after that commencement.</p>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-61">
            <num>61</num>
            <heading>Subsection 33(1)</heading>
            <content>
              <p>Omit “or 32”, substitute “, 32 or 33J”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-62">
            <num>62</num>
            <heading>Subsection 33(3)</heading>
            <content>
              <p>Omit “or monitoring”, substitute “, monitoring or inquiry”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-63">
            <num>63</num>
            <heading>After Division 3A of Part IV</heading>
            <content>
              <p>Insert:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-33E">
            <num>33E</num>
            <heading>Inquiries by Commissioner</heading>
            <content>
              <p>Minister may give direction or approval for public inquiry</p>
              <p>Conduct of inquiry</p>
              <p>Status of inquiries, directions and approvals</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-33E__subclause-1">
              <num>1</num>
              <content>
                <p><role refersTo="#minister">The Minister</role> may, in writing, direct <role refersTo="#commissioner">the Commissioner</role> to conduct, or approve <role refersTo="#commissioner">the Commissioner</role> conducting, a public inquiry into a specified matter or specified matters relating to privacy.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-33E__subclause-2">
              <num>2</num>
              <content>
                <p>The direction or approval must specify:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-33E__para-a">
              <num>a</num>
              <content>
                <p>the acts or practices in relation to which the inquiry is to be held; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-33E__para-b">
              <num>b</num>
              <content>
                <p>the types of personal information in relation to which the inquiry is to be held.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-33E__subclause-3">
              <num>3</num>
              <content>
                <p>The direction or approval may also specify any one or more of the following:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-33E__para-a">
              <num>a</num>
              <content>
                <p>the date by which the inquiry is to be completed;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-33E__para-b">
              <num>b</num>
              <content>
                <p>any directions in relation to the manner in which the inquiry is to be conducted;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-33E__para-c">
              <num>c</num>
              <content>
                <p>one or more APP entities that are to be the subject of the inquiry;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-33E__para-d">
              <num>d</num>
              <content>
                <p>one or more classes of APP entities that are to be the subject of the inquiry;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-33E__para-e">
              <num>e</num>
              <content>
                <p>any matters to be taken into consideration in the inquiry.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-33E__subclause-4">
              <num>4</num>
              <content>
                <p><role refersTo="#minister">The Minister</role> may vary a direction or approval.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-33E__subclause-5">
              <num>5</num>
              <content>
                <p><role refersTo="#commissioner">The Commissioner</role> must conduct a public inquiry in accordance with a direction or approval given under subsection (1).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-33E__subclause-6">
              <num>6</num>
              <content>
                <p>	(6)	Subject to any directions given by the Minister in accordance with paragraph (3)(b), the Commissioner may<i> </i>conduct the inquiry in such manner as the Commissioner thinks fit.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-33E__subclause-7">
              <num>7</num>
              <content>
                <p>To avoid doubt, an inquiry does not constitute an investigation under <ref href="#sec-40">section 40</ref> nor a preliminary inquiry under <ref href="#sec-42">section 42</ref>.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-33E__subclause-8">
              <num>8</num>
              <content>
                <p>A direction or approval given under subsection (1) is not a legislative instrument.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-33F">
            <num>33F</num>
            <heading>Commissioner may invite submissions</heading>
            <content>
              <p><role refersTo="#commissioner">The Commissioner</role> may invite submissions on matters that are the subject of a public inquiry.</p>
              <p>Note:	Under subsection 33E(6), <role refersTo="#commissioner">the Commissioner</role> may require submissions to be in writing.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-33G">
            <num>33G</num>
            <heading>Commissioner not bound by the rules of evidence</heading>
            <content>
              <p><role refersTo="#commissioner">The Commissioner</role> is not bound by the rules of evidence and may inform themselves on any matter in such manner as <role refersTo="#commissioner">the Commissioner</role> thinks fit.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-33H">
            <num>33H</num>
            <heading>Commissioner’s powers</heading>
            <content>
              <p>Sections 44 (power to obtain information or documents) and 45 (power to examine witnesses) apply for the purposes of a public inquiry in the same way as those provisions apply to an investigation under <ref href="#part-V">Part V</ref>.</p>
              <p>Note 1:	Other provisions may apply on their own terms, such as <ref href="#sec-33B">section 33B</ref> (Commissioner may disclose certain information if in the public interest etc.).</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-33J">
            <num>33J</num>
            <heading>Reporting on public inquiries</heading>
            <content>
              <p>Commissioner to report on public inquiries</p>
              <p>Requirement to give report to APP entity</p>
              <p>Contents of report</p>
              <p>Note:	For paragraph (a), the report may include previously made findings or recommendations that specific acts or practices interfere with the privacy of individuals.</p>
              <p>Making report public</p>
              <p>Note:	<role refersTo="#commissioner">The Commissioner</role> may, under section 33B, publish other information relating to the inquiry if it is in the public interest to do so.</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-33J__subclause-1">
              <num>1</num>
              <content>
                <p>After completing a public inquiry, <role refersTo="#commissioner">the Commissioner</role> must prepare a written report on the inquiry and give the report to <role refersTo="#minister">the Minister</role>.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-33J__subclause-2">
              <num>2</num>
              <content>
                <p>If a direction or approval specifies one or more entities under paragraph 33E(3)(c), <role refersTo="#commissioner">the Commissioner</role> must give the entities a copy of the report on the day <role refersTo="#commissioner">the Commissioner</role> gives the report to <role refersTo="#minister">the Minister</role> under subsection (1) of this section.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-33J__subclause-3">
              <num>3</num>
              <content>
                <p>The report may include findings and recommendations in relation to any matter included in the report.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-33J__subclause-4">
              <num>4</num>
              <content>
                <p>The report must not:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-33J__para-a">
              <num>a</num>
              <content>
                <p>make any finding or recommendation that a specific act or practice is an interference with the privacy of an individual; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-33J__para-b">
              <num>b</num>
              <content>
                <p>include any matter which <role refersTo="#commissioner">the Commissioner</role> thinks it is desirable to exclude under section 33.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-33J__subclause-5">
              <num>5</num>
              <content>
                <p><role refersTo="#minister">The Minister</role> must table a copy of the report before each House of the Parliament within 15 sitting days of that House after the day on which <role refersTo="#minister">the Minister</role> receives the report.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-33J__subclause-6">
              <num>6</num>
              <content>
                <p>Unless <role refersTo="#minister">the Minister</role> otherwise directs, <role refersTo="#commissioner">the Commissioner</role> must make the report publicly available.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-64">
            <num>64</num>
            <heading>Application of amendments</heading>
            <content>
              <p><i>Privacy Act 1988</i>, as inserted by this Part, applies in relation to public inquiries commenced on or after the commencement of this Part, whether the matter to which the inquiry relates arose, before or after that commencement.<ref href="#dvs-3B">Division 3B</ref> of <ref href="#part-I">Part I</ref>V of the </p>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-65">
            <num>65</num>
            <heading>Subparagraph 52(1)(b)(ii)</heading>
            <content>
              <p>After “damage suffered”, insert “, or to prevent or reduce any reasonably foreseeable loss or damage that is likely to be suffered,”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-66">
            <num>66</num>
            <heading>Paragraph 52(1A)(c)</heading>
            <content>
              <p>After “damage suffered”, insert “, or to prevent or reduce any reasonably foreseeable loss or damage that is likely to be suffered,”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-67">
            <num>67</num>
            <heading>Application of amendments</heading>
            <content>
              <p>The amendments of <i>Privacy Act 1988</i> made by this Part apply in relation to determinations made after the commencement of this Part.<ref href="#sec-52">section 52</ref> of the </p>
              <p>Australian Information Commissioner Act 2010</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-68">
            <num>68</num>
            <heading>Paragraph 32(1)(a)</heading>
            <content>
              <p>After “performance”, insert “during the year”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-69">
            <num>69</num>
            <heading>Paragraph 32(1)(b)</heading>
            <content>
              <p>After “made”, insert “during the year”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-70">
            <num>70</num>
            <heading>At the end of subsection 32(1)</heading>
            <content>
              <p>Add:</p>
              <p>	; (c)	a statement including details about the number of complaints made under <i>Privacy Act 1988 </i>during the year;<ref href="#sec-36">section 36</ref> of the </p>
            </content>
            <paragraph eId="schedule-1__clause-70__para-d">
              <num>d</num>
              <content>
                <p><b>	</b>(d)	a statement including details about the number of complaints<i> </i>made under section 36 of the <i>Privacy Act 1988</i> in relation to which the Commissioner has decided during the year under section 41 of that Act<i> </i>not to investigate, or not to investigate further, and the relevant grounds for the decision.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-71">
            <num>71</num>
            <heading>Application of amendments</heading>
            <content>
              <p>The amendments of <i>Australian Information Commissioner Act 2010</i> made by this Part apply in relation to an annual report for a period beginning<i> </i>after the commencement of this Part.<ref href="#sec-32">section 32</ref> of the </p>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-72">
            <num>72</num>
            <heading>Paragraph 41(1)(dc)</heading>
            <content>
              <p>After “is being dealt with”, insert “, or has been dealt with,”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-73">
            <num>73</num>
            <heading>Application of amendments</heading>
            <content>
              <p>The amendment of <i>Privacy Act 1988</i> made by this Part applies in relation to any complaint made:<ref href="#sec-41">section 41</ref> of the </p>
              <p>Competition and Consumer Act 2010</p>
            </content>
            <paragraph eId="schedule-1__clause-73__para-a">
              <num>a</num>
              <content>
                <p>before the commencement of this Part if the complaint has not been finalised by <role refersTo="#commissioner">the Commissioner</role> by that commencement; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-73__para-b">
              <num>b</num>
              <content>
                <p>after the commencement of this Part.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-74">
            <num>74</num>
            <heading>Subsection 56ET(3) (at the end of the note)</heading>
            <content>
              <p>Add “The Information Commissioner also has the power, under <i>Privacy Act 1988</i>, to investigate contraventions of civil penalty provisions in Division 5 of Part IVD of this Act.”.<ref href="#dvs-1AC">Division 1AC</ref> of <ref href="#part-VI">Part VI</ref>B of the </p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-75">
            <num>75</num>
            <heading>Subsection 56ET(4) (item 5 of the table)</heading>
            <content>
              <p>Repeal the item.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-76">
            <num>76</num>
            <heading>Subsection 56ET(4) (note 1)</heading>
            <content>
              <p>Omit “Note 1”, substitute “Note”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-77">
            <num>77</num>
            <heading>Subsection 56ET(4) (note 2)</heading>
            <content>
              <p>Repeal the note.</p>
              <p>Crimes Act 1914</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-78">
            <num>78</num>
            <heading>Subsection 85ZZG(1)</heading>
            <content>
              <p>Omit “68”, substitute “67”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-79">
            <num>79</num>
            <heading>At the end of subsection 85ZZG(1)</heading>
            <content>
              <p>Add:</p>
              <p>Note:	In addition, under subsection 80TB(1) of the <i>Privacy Act 1988</i>, the Commissioner has the power to monitor, under the Regulatory Powers Act, compliance with Divisions 2 and 3 of this Part.</p>
              <p>Data-matching Program (Assistance and Tax) Act 1990</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-80">
            <num>80</num>
            <heading>Subsection 13(7)</heading>
            <content>
              <p>Add:</p>
              <p>Note:	In addition, under paragraphs 80TB(1)(b) and (3)(b) of the <i>Privacy Act 1988</i>, the Commissioner has the power to monitor, under the Regulatory Powers Act, compliance with this Act or rules issued under section 12. See also paragraph 33C(1)(d) of that Act.</p>
              <p>National Health Act 1953</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-81">
            <num>81</num>
            <heading>Subsection 135AB(3)</heading>
            <content>
              <p>After “<ref href="#part-V">Part V</ref>”, insert “, and <ref href="#dvs-1AC">Division 1AC</ref> of <ref href="#part-VIB">Part VIB</ref>,”.</p>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-82">
            <num>82</num>
            <heading>Subsection 6(1)</heading>
            <content>
              <p>Insert:</p>
              <p><b><i>member of the staff of the Commissioner</i></b> means a person referred to in section 23 of the <i>Australian Information Commissioner Act 2010</i>.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-83">
            <num>83</num>
            <heading>Sections 68 and 68A</heading>
            <content>
              <p>Repeal the sections.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-84">
            <num>84</num>
            <heading>Part VIB (heading)</heading>
            <content>
              <p>Repeal the heading, substitute:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-85">
            <num>85</num>
            <heading>Before Division 1 of Part VIB</heading>
            <content>
              <p>Insert:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-80TA">
            <num>80TA</num>
            <heading>Simplified outline of this Part</heading>
            <content>
              <p>Certain provisions, information and matters are subject to monitoring under Part 2 of the Regulatory Powers Act.</p>
              <p>Certain provisions are subject to investigation under Part 3 of the Regulatory Powers Act.</p>
              <p>Civil penalty orders may be sought under Part 4 of the Regulatory Powers Act from a relevant court in relation to contraventions of civil penalty provisions. If a relevant court has determined, or will determine, under the Regulatory Powers Act that an entity has contravened certain civil penalty provisions of this Act, the court may make other orders in the proceeding.</p>
              <p>Infringement notices may be given under Part 5 of the Regulatory Powers Act for alleged contraventions of certain provisions.</p>
              <p>Undertakings to comply with the provisions of this Act may be accepted and enforced under Part 6 of the Regulatory Powers Act.</p>
              <p>Injunctions under Part 7 of the Regulatory Powers Act may be used to restrain a person from contravening a provision of this Act or to compel compliance with a provision of this Act.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-80TB">
            <num>80TB</num>
            <heading>Monitoring powers</heading>
            <content>
              <p>Provisions subject to monitoring</p>
              <p>Note:	Part 2 of the Regulatory Powers Act creates a framework for monitoring whether the provisions mentioned in this subsection have been complied with. It includes powers of entry and inspection.</p>
              <p>Information subject to monitoring</p>
              <p>Note:	Part 2 of the Regulatory Powers Act creates a framework for monitoring whether the information is correct. It includes powers of entry and inspection.</p>
              <p>Matters subject to monitoring</p>
              <p>Note:	Part 2 of the Regulatory Powers Act creates a framework for monitoring the matters mentioned in this subsection. It includes powers of entry and inspection.</p>
              <p>Authorised applicant</p>
              <p>Authorised person</p>
              <p>Issuing officer</p>
              <p>Relevant chief executive</p>
              <p>Relevant court</p>
              <p>Person assisting</p>
              <p>Extension to external Territories</p>
              <p>Relationship with other provisions</p>
              <p>Note:	Section 70 deals with certain documents and information not required to be disclosed.</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-1">
              <num>1</num>
              <content>
                <p>The following provisions are subject to monitoring under Part 2 of the Regulatory Powers Act:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TB__para-a">
              <num>a</num>
              <content>
                <p>	(a)	Divisions 2 and 3 of <i>Crimes Act 1914</i> (pardons, and quashed and spent convictions);<ref href="#part-VII">Part VII</ref>C of the </p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-b">
              <num>b</num>
              <content>
                <p>	(b)	Part 2 of the <i>Data</i><i>-</i><i>matching Program (Assistance and Tax) Act 1990</i>, or rules issued under section 12 of that Act.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-2">
              <num>2</num>
              <content>
                <p>Information given in compliance, or purported compliance, with any of the following provisions is subject to monitoring under Part 2 of the Regulatory Powers Act:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TB__para-a">
              <num>a</num>
              <content>
                <p>subsection 26WU(3) (power to obtain information and documents relating to eligible data breaches);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-b">
              <num>b</num>
              <content>
                <p>subsection 33C(3) (requirement to provide information relating to an assessment);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-c">
              <num>c</num>
              <content>
                <p>subsection 44(1) (requirement to provide information relating to investigations).</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-3">
              <num>3</num>
              <content>
                <p>The following matters are subject to monitoring under the Regulatory Powers Act:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TB__para-a">
              <num>a</num>
              <content>
                <p>a matter referred to in subsection 28A(1) of this Act in relation to which <role refersTo="#commissioner">the Commissioner</role> has a monitoring related function (credit reporting and tax file number monitoring-related functions);</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-b">
              <num>b</num>
              <content>
                <p>a matter referred to in subsection 33C(1) of this Act if <role refersTo="#commissioner">the Commissioner</role> is undertaking an assessment of the matter (assessments related to Australian Privacy Principles).</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-4">
              <num>4</num>
              <content>
                <p>For the purposes of Part 2 of the Regulatory Powers Act, each of the following persons is an authorised applicant in relation to the provisions mentioned in subsection (1), the information mentioned in subsection (2), and the matters mentioned in subsection (3):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TB__para-a">
              <num>a</num>
              <content>
                <p><role refersTo="#commissioner">the Commissioner</role>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-b">
              <num>b</num>
              <content>
                <p>a member of the staff of <role refersTo="#commissioner">the Commissioner</role> who is an SES employee, or an acting SES employee, or who holds, or is acting in, a position that is equivalent to, or higher than, a position occupied by an SES employee.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-5">
              <num>5</num>
              <content>
                <p>For the purposes of Part 2 of the Regulatory Powers Act, each of the following persons is an authorised person in relation to the provisions mentioned in subsection (1), the information mentioned in subsection (2), and the matters mentioned in subsection (3):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TB__para-a">
              <num>a</num>
              <content>
                <p><role refersTo="#commissioner">the Commissioner</role>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-b">
              <num>b</num>
              <content>
                <p>a member of the staff of <role refersTo="#commissioner">the Commissioner</role> who is authorised in writing by <role refersTo="#commissioner">the Commissioner</role> or a delegate of <role refersTo="#commissioner">the Commissioner</role>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-c">
              <num>c</num>
              <content>
                <p>a consultant who is:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-i">
              <num>i</num>
              <content>
                <p>	(i)	engaged under <i>Australian Information Commissioner Act 2010</i> in relation to performance of the functions or the exercise of the powers of the Commissioner; and<ref href="#sec-24">section 24</ref> of the </p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-ii">
              <num>ii</num>
              <content>
                <p>authorised in writing by <role refersTo="#commissioner">the Commissioner</role> or a delegate of <role refersTo="#commissioner">the Commissioner</role>.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-6">
              <num>6</num>
              <content>
                <p>For the purposes of Part 2 of the Regulatory Powers Act, any judicial officer within the meaning of the Regulatory Powers Act is an issuing officer in relation to the provisions mentioned in subsection (1), the information mentioned in subsection (2), and the matters mentioned in subsection (3).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-7">
              <num>7</num>
              <content>
                <p>For the purposes of Part 2 of the Regulatory Powers Act, <role refersTo="#commissioner">the Commissioner</role> is the relevant chief executive in relation to the provisions mentioned in subsection (1), the information mentioned in subsection (2), and the matters mentioned in subsection (3).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-8">
              <num>8</num>
              <content>
                <p>The relevant chief executive may, in writing, delegate the relevant chief executive’s powers and functions under Part 2 of the Regulatory Powers Act in relation to the provisions mentioned in subsection (1), the information mentioned in subsection (2), and the matters mentioned in subsection (3), to a person who is:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TB__para-a">
              <num>a</num>
              <content>
                <p>a member of the staff of <role refersTo="#commissioner">the Commissioner</role>; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-b">
              <num>b</num>
              <content>
                <p>an SES employee, or an acting SES employee, or who holds, or is acting in, a position that is equivalent to, or higher than, a position occupied by an SES employee.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-9">
              <num>9</num>
              <content>
                <p>A person exercising powers or performing functions under a delegation under subsection (8) must comply with any directions of the relevant chief executive.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-10">
              <num>10</num>
              <content>
                <p>For the purposes of Part 2 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the provisions mentioned in subsection (1), the information mentioned in subsection (2), and the matters mentioned in subsection (3):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TB__para-a">
              <num>a</num>
              <content>
                <p>the Federal Court of Australia;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TB__para-b">
              <num>b</num>
              <content>
                <p>the Federal Circuit and Family Court of Australia (<ref href="#dvs-2">Division 2</ref>).</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-11">
              <num>11</num>
              <content>
                <p>An authorised person may be assisted by other persons in exercising powers or performing functions or duties under Part 2 of the Regulatory Powers Act in relation to the provisions mentioned in subsection (1), the information mentioned in subsection (2), and the matters mentioned in subsection (3).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-12">
              <num>12</num>
              <content>
                <p>	(12)	Part 2 of the Regulatory Powers Act, as that Part applies in relation to<i> </i>the provisions mentioned in subsection (1), the information mentioned in subsection (2), and the matters mentioned in subsection (3), extends to every external Territory.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80TB__subclause-13">
              <num>13</num>
              <content>
                <p>	(13)	Part 2 of the Regulatory Powers Act, as that Part applies in relation to<i> </i>the provisions mentioned in subsection (1), the information mentioned in subsection (2), and the matters mentioned in subsection (3), is subject to section 70 of this Act.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-80TC">
            <num>80TC</num>
            <heading>Modifications of Part 2 of the Regulatory Powers Act</heading>
            <content>
              <p>Use of force in executing a monitoring warrant</p>
              <p>In executing a monitoring warrant under Part 2 of the Regulatory Powers Act, as that Part applies in relation to the provisions mentioned in subsection 80TB(1), the information mentioned in subsection 80TB(2), and the matters mentioned in subsection 80TB(3), of this Act:</p>
            </content>
            <paragraph eId="schedule-1__clause-80TC__para-a">
              <num>a</num>
              <content>
                <p>an authorised person may use such force against things as is necessary and reasonable in the circumstances; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TC__para-b">
              <num>b</num>
              <content>
                <p>a person assisting the authorised person may use such force against things as is necessary and reasonable in the circumstances.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-80TD">
            <num>80TD</num>
            <heading>Investigation powers</heading>
            <content>
              <p>Provisions subject to investigation</p>
              <p>Note 1:	Part 3 of the Regulatory Powers Act creates a framework for investigating whether a provision has been contravened. It includes powers of entry, search and seizure.</p>
              <p>Note 2:	Part 3 of the Regulatory Powers Act is modified by <ref href="#sec-80T">section 80T</ref>E.</p>
              <p>Note 3:	Subparagraph (1)(b)(iv) is subject to subsection 80TE(2).</p>
              <p>Authorised applicant</p>
              <p>Authorised person</p>
              <p>Issuing officer</p>
              <p>Relevant chief executive</p>
              <p>Relevant court</p>
              <p>Person assisting</p>
              <p>Extension to external Territories</p>
              <p>Relationship with other provisions</p>
              <p>Note:	Section 70 deals with certain documents and information not required to be disclosed.</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-1">
              <num>1</num>
              <content>
                <p>A provision is subject to investigation under Part 3 of the Regulatory Powers Act if it is:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TD__para-a">
              <num>a</num>
              <content>
                <p>an offence provision, or a civil penalty provision, in this Act; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-b">
              <num>b</num>
              <content>
                <p>any of the following:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-i">
              <num>i</num>
              <content>
                <p>	(i)	a civil penalty provision that is enforceable by the Commissioner under the <i>Digital ID Act 2024</i>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-ii">
              <num>ii</num>
              <content>
                <p>	(ii)	a civil penalty provision that is enforceable by the Commissioner under the <i>Healthcare Identifiers Act 2010</i> or an instrument made under that Act;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-iii">
              <num>iii</num>
              <content>
                <p>	(iii)	a civil penalty provision that is enforceable by the Commissioner under the <i>My Health Records Act 2012</i>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-iv">
              <num>iv</num>
              <content>
                <p>	(iv)	a civil penalty provision that is enforceable by the Commissioner under <i>Competition and Consumer Act 2010</i>; or<ref href="#dvs-5">Division 5</ref> of <ref href="#part-IV">Part IV</ref>D of the </p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-c">
              <num>c</num>
              <content>
                <p>	(c)	an offence provision of the <i>Crimes Act 1914</i> or the <i>Criminal Code</i>, to the extent<i> </i>that it relates to an offence provision in this Act.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-2">
              <num>2</num>
              <content>
                <p>For the purposes of Part 3 of the Regulatory Powers Act, each of the following persons is an authorised applicant in relation to evidential material that relates to a provision mentioned in subsection (1):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TD__para-a">
              <num>a</num>
              <content>
                <p><role refersTo="#commissioner">the Commissioner</role>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-b">
              <num>b</num>
              <content>
                <p>a member of the staff of <role refersTo="#commissioner">the Commissioner</role> who is an SES employee, or an acting SES employee, or who holds, or is acting in, a position that is equivalent to, or higher than, a position occupied by an SES employee.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-3">
              <num>3</num>
              <content>
                <p>For the purposes of Part 3 of the Regulatory Powers Act, each of the following persons is an authorised person in relation to evidential material that relates to a provision mentioned in subsection (1):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TD__para-a">
              <num>a</num>
              <content>
                <p><role refersTo="#commissioner">the Commissioner</role>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-b">
              <num>b</num>
              <content>
                <p>a member of the staff of <role refersTo="#commissioner">the Commissioner</role> who is authorised in writing by <role refersTo="#commissioner">the Commissioner</role> or a delegate of <role refersTo="#commissioner">the Commissioner</role>;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-c">
              <num>c</num>
              <content>
                <p>a consultant who is:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-i">
              <num>i</num>
              <content>
                <p>	(i)	engaged under <i>Australian Information Commissioner Act 2010</i> in relation to performance of the functions or the exercise of the powers of the Commissioner; and<ref href="#sec-24">section 24</ref> of the </p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-ii">
              <num>ii</num>
              <content>
                <p>authorised in writing by <role refersTo="#commissioner">the Commissioner</role> or a delegate of <role refersTo="#commissioner">the Commissioner</role>.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-4">
              <num>4</num>
              <content>
                <p>For the purposes of Part 3 of the Regulatory Powers Act, any judicial officer within the meaning of the Regulatory Powers Act is an issuing officer in relation to evidential material that relates to a provision mentioned in subsection (1).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-5">
              <num>5</num>
              <content>
                <p>For the purposes of Part 3 of the Regulatory Powers Act, <role refersTo="#commissioner">the Commissioner</role> is the relevant chief executive in relation to evidential material that relates to a provision mentioned in subsection (1).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-6">
              <num>6</num>
              <content>
                <p>The relevant chief executive may, in writing, delegate the relevant chief executive’s powers and functions under Part 3 of the Regulatory Powers Act in relation to evidential material that relates to a provision mentioned in subsection (1) to a person who is:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TD__para-a">
              <num>a</num>
              <content>
                <p>a member of the staff of <role refersTo="#commissioner">the Commissioner</role>; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-b">
              <num>b</num>
              <content>
                <p>an SES employee, or an acting SES employee, or who holds, or is acting in, a position that is equivalent to, or higher than, a position occupied by an SES employee.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-7">
              <num>7</num>
              <content>
                <p>A person exercising powers or performing functions under a delegation under subsection (6) must comply with any directions of the relevant chief executive.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-8">
              <num>8</num>
              <content>
                <p>For the purposes of Part 3 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the provisions mentioned in subsection (1):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TD__para-a">
              <num>a</num>
              <content>
                <p>the Federal Court of Australia;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TD__para-b">
              <num>b</num>
              <content>
                <p>the Federal Circuit and Family Court of Australia (<ref href="#dvs-2">Division 2</ref>).</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-9">
              <num>9</num>
              <content>
                <p>An authorised person may be assisted by other persons in exercising powers or performing functions or duties under Part 3 of the Regulatory Powers Act in relation to evidential material that relates to a provision mentioned in subsection (1).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-10">
              <num>10</num>
              <content>
                <p>	(10)	Part 3 of the Regulatory Powers Act, as that Part applies in relation to<i> </i>the provisions mentioned in subsection (1), extends to every external Territory.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-80TD__subclause-11">
              <num>11</num>
              <content>
                <p>	(11)	Part 3 of the Regulatory Powers Act, as that Part applies in relation to<i> </i>the provisions mentioned in subsection (1), is subject to section 70 of this Act.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-80TE">
            <num>80TE</num>
            <heading>Modifications of Part 3 of the Regulatory Powers Act</heading>
            <content>
              <p>Use of force in executing an investigation warrant</p>
              <p>Limitation on use of investigation powers in relation to matters under the Competition and Consumer Act</p>
              <p>(all within the meaning of the <i>Competition and Consumer Act 2010</i>).</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-80TE__subclause-1">
              <num>1</num>
              <content>
                <p>In executing an investigation warrant under Part 3 of the Regulatory Powers Act, as that Part applies in relation to evidential material that relates to a provision mentioned in subsection 80TD(1) of this Act:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TE__para-a">
              <num>a</num>
              <content>
                <p>an authorised person may use such force against things as is necessary and reasonable in the circumstances; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TE__para-b">
              <num>b</num>
              <content>
                <p>a person assisting the authorised person may use such force against things as is necessary and reasonable in the circumstances.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-1__clause-80TE__subclause-2">
              <num>2</num>
              <content>
                <p>	(2)	If a civil penalty provision that is enforceable by the Commissioner under <i>Competition and Consumer </i><i>Act 2010 </i>is subject to investigation under Part 3 of the Regulatory Powers Act, the powers under that Part may be exercised in relation to premises only if the premises are occupied by or on behalf of:<ref href="#dvs-5">Division 5</ref> of <ref href="#part-IV">Part IV</ref>D of the </p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-1__clause-80TE__para-a">
              <num>a</num>
              <content>
                <p>a CDR participant for CDR data; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TE__para-b">
              <num>b</num>
              <content>
                <p>an accredited person who may become an accredited data recipient of CDR data; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TE__para-c">
              <num>c</num>
              <content>
                <p>a designated gateway for CDR data; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-80TE__para-d">
              <num>d</num>
              <content>
                <p>an action service provider for a type of CDR action who has been, or may be, disclosed CDR data under the consumer data rules;</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-86">
            <num>86</num>
            <heading>Application of amendments</heading>
            <hcontainer name="subclause" eId="schedule-1__clause-86__subclause-1">
              <num>1</num>
              <content>
                <p>(1)	Divisions 1AB and 1AC of <i>Privacy Act 1988</i>, as inserted by this Part, apply in relation to monitoring and investigating matters after the commencement of this Part, whether in relation to acts or practices before or after the commencement of this Part.<ref href="#part-VI">Part VI</ref>B of the </p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-86__subclause-2">
              <num>2</num>
              <content>
                <p>(2)	The amendment of subsection 135AB(3) of the <i>National Health Act 1953</i> made by this Part applies in relation to monitoring and investigating matters after the commencement of this Part, whether in relation to acts or practices before or after the commencement of this Part.</p>
              </content>
            </hcontainer>
            <content>
              <p>Privacy Act 1988</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-87">
            <num>87</num>
            <heading>After subparagraph 13K(1)(b)(ii)</heading>
            <content>
              <p>Insert:</p>
            </content>
            <paragraph eId="schedule-1__clause-87__para-iia">
              <num>iia</num>
              <content>
                <p>Australian Privacy Principle 1.7 (contents of APP privacy policy—automated decisions);</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-88">
            <num>88</num>
            <heading>At the end of clause 1 of Schedule 1</heading>
            <content>
              <p>Add:</p>
              <p>Automated decisions</p>
            </content>
            <hcontainer name="subclause" eId="schedule-1__clause-88__subclause-1-7">
              <num>1.7</num>
              <content>
                <p>Without limiting subclause 1.3, the APP privacy policy of an APP entity must contain the information covered by subclause 1.8 if:</p>
              </content>
              <paragraph eId="schedule-1__clause-88__subclause-1-7__para-a">
                <num>a</num>
                <content>
                  <p>the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-88__subclause-1-7__para-b">
                <num>b</num>
                <content>
                  <p>the decision could reasonably be expected to significantly affect the rights or interests of an individual; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-88__subclause-1-7__para-c">
                <num>c</num>
                <content>
                  <p>personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.</p>
                </content>
              </paragraph>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-88__subclause-1-8">
              <num>1.8</num>
              <content>
                <p>The information covered by this subclause is:</p>
              </content>
              <paragraph eId="schedule-1__clause-88__subclause-1-8__para-a">
                <num>a</num>
                <content>
                  <p>the kinds of personal information used in the operation of such computer programs; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-88__subclause-1-8__para-b">
                <num>b</num>
                <content>
                  <p>the kinds of such decisions made solely by the operation of such computer programs; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-88__subclause-1-8__para-c">
                <num>c</num>
                <content>
                  <p>the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.</p>
                </content>
              </paragraph>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-1__clause-88__subclause-1-9">
              <num>1.9</num>
              <content>
                <p>For the purposes of subclauses 1.7 and 1.8:</p>
              </content>
              <paragraph eId="schedule-1__clause-88__subclause-1-9__para-a">
                <num>a</num>
                <content>
                  <p>making a decision includes refusing or failing to make a decision; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-88__subclause-1-9__para-b">
                <num>b</num>
                <content>
                  <p>doing a thing includes refusing or failing to do a thing; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-88__subclause-1-9__para-c">
                <num>c</num>
                <content>
                  <p>a decision may affect the rights or interests of an individual, whether the rights or interests of the individual are adversely or beneficially affected; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-88__subclause-1-9__para-d">
                <num>d</num>
                <content>
                  <p>the following are examples of the kinds of decisions that may affect the rights or interests of an individual:</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-88__subclause-1-9__para-i">
                <num>i</num>
                <content>
                  <p>a decision made under a provision of an Act or a legislative instrument to grant, or to refuse to grant, a benefit to the individual;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-88__subclause-1-9__para-ii">
                <num>ii</num>
                <content>
                  <p>a decision that affects the individual’s rights under a contract, agreement or arrangement;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-1__clause-88__subclause-1-9__para-iii">
                <num>iii</num>
                <content>
                  <p>a decision that affects the individual’s access to a significant service or support.</p>
                </content>
              </paragraph>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-1__clause-89">
            <num>89</num>
            <heading>Application of amendment</heading>
            <content>
              <p>The amendment of clause 1 of Schedule 1 to the <i>Privacy Act 1988</i> made by this Part applies in relation to decisions made after the commencement of this item, whether:</p>
            </content>
            <paragraph eId="schedule-1__clause-89__para-a">
              <num>a</num>
              <content>
                <p>the arrangement for a computer program to make the decision, or do a thing that is substantially and directly related to making the decision, was made before or after that commencement; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-89__para-b">
              <num>b</num>
              <content>
                <p>the use of personal information in the operation of the computer program occurred before or after that commencement; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-1__clause-89__para-c">
              <num>c</num>
              <content>
                <p>the personal information used in the operation of the computer program was acquired or created before or after that commencement.</p>
              </content>
            </paragraph>
          </hcontainer>
        </hcontainer>
      </attachment>
      <attachment>
        <hcontainer name="schedule" eId="schedule-2">
          <heading>Serious invasions of privacy</heading>
          <content>
            <p>Privacy Act 1988</p>
          </content>
          <hcontainer name="clause" eId="schedule-2__clause-1">
            <num>1</num>
            <heading>Section 2A</heading>
            <content>
              <p>Before “The objects”, insert “(1)”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-2__clause-2">
            <num>2</num>
            <heading>At the end of section 2A</heading>
            <content>
              <p>Add:</p>
              <p>Note:	See also clause 1 of Schedule 2 (objects).</p>
            </content>
            <hcontainer name="subclause" eId="schedule-2__clause-2__subclause-2">
              <num>2</num>
              <content>
                <p>This section does not apply to Schedule 2.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-2__clause-3">
            <num>3</num>
            <heading>Section 3</heading>
            <content>
              <p>Before “It is”, insert “(1)”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-2__clause-4">
            <num>4</num>
            <heading>At the end of section 3</heading>
            <content>
              <p>Add:</p>
              <p>Note:	See also clause 21 of Schedule 2 (saving of other laws).</p>
            </content>
            <hcontainer name="subclause" eId="schedule-2__clause-4__subclause-2">
              <num>2</num>
              <content>
                <p>This section does not apply to Schedule 2.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-2__clause-5">
            <num>5</num>
            <heading>Section 5A</heading>
            <content>
              <p>Before “This Act”, insert “(1)”.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-2__clause-6">
            <num>6</num>
            <heading>At the end of section 5A</heading>
            <content>
              <p>Add:</p>
            </content>
            <hcontainer name="subclause" eId="schedule-2__clause-6__subclause-2">
              <num>2</num>
              <content>
                <p>This section does not apply to Schedule 2.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-2__clause-7">
            <num>7</num>
            <heading>At the end of section 5B</heading>
            <content>
              <p>Add:</p>
              <p>Application</p>
            </content>
            <hcontainer name="subclause" eId="schedule-2__clause-7__subclause-5">
              <num>5</num>
              <content>
                <p>This section does not apply to Schedule 2.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-2__clause-8">
            <num>8</num>
            <heading>At the end of section 12B</heading>
            <content>
              <p>Add:</p>
              <p>Note:	See also clauses 4 and 5 of Schedule 2 (constitutional basis and additional operation).</p>
            </content>
            <hcontainer name="subclause" eId="schedule-2__clause-8__subclause-9">
              <num>9</num>
              <content>
                <p>This section does not apply to Schedule 2.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-2__clause-9">
            <num>9</num>
            <heading>Before section 95 of Part IX</heading>
            <content>
              <p>Insert:</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-2__clause-94A">
            <num>94A</num>
            <heading>Schedule 2</heading>
            <hcontainer name="subclause" eId="schedule-2__clause-94A__subclause-1">
              <num>1</num>
              <content>
                <p>Schedule 2 has effect.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-2__clause-94A__subclause-2">
              <num>2</num>
              <content>
                <p>In determining the meaning of an expression used in a provision of this Act (other than Schedule 2), an expression used in Schedule 2 is to be disregarded.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-2__clause-94A__subclause-3">
              <num>3</num>
              <content>
                <p>In determining the meaning of a provision of this Act (other than Schedule 2), Schedule 2 is to be disregarded.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-2__clause-10">
            <num>10</num>
            <heading>At the end of the Act</heading>
            <content>
              <p>Add:</p>
            </content>
          </hcontainer>
        </hcontainer>
      </attachment>
      <attachment>
        <hcontainer name="schedule" eId="schedule-3">
          <heading>Statutory Tort for Serious Invasions of Privacy</heading>
          <content>
            <p>Note:	See <ref href="#sec-94A">section 94A</ref>.</p>
          </content>
          <hcontainer name="clause" eId="schedule-3__clause-1">
            <num>1</num>
            <heading>Objects of this Schedule</heading>
            <content>
              <p>The objects of this Schedule are to:</p>
            </content>
            <paragraph eId="schedule-3__clause-1__para-a">
              <num>a</num>
              <content>
                <p>establish a cause of action for serious invasions of privacy; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-1__para-b">
              <num>b</num>
              <content>
                <p>provide for defences, remedies and exemptions in respect of the cause of action; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-1__para-c">
              <num>c</num>
              <content>
                <p>recognise that there is a public interest in protecting privacy; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-1__para-d">
              <num>d</num>
              <content>
                <p>recognise that the public interest in protecting privacy is balanced with other public interests; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-1__para-e">
              <num>e</num>
              <content>
                <p>implement Australia’s international obligations in relation to privacy.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-2">
            <num>2</num>
            <heading>Simplified outline of this Schedule</heading>
            <content>
              <p>This Schedule establishes a cause of action in tort for serious invasions of privacy.</p>
              <p>An individual has a cause of action against another person if, among other things, the other person invaded the individual’s privacy by intruding upon their seclusion or misusing information relating to them.</p>
              <p>It is a defence to the cause of action if the other person acted with lawful authority or in certain circumstances involving consent, necessity or the defence of persons or property. If the invasion of privacy involved the publication of information, the other person may also have access to certain defences that would ordinarily arise in the context of defamation proceedings.</p>
              <p>Exemptions apply in relation to intelligence agencies and law enforcement bodies, persons disclosing information to such agencies or bodies, persons using information disclosed by such agencies or bodies, and persons under 18 years of age. Journalists and certain other persons are also exempt in certain circumstances.</p>
              <p>The court may, during the proceedings, grant an injunction restraining the other person from invading the individual’s privacy. The court may also summarily dismiss the proceedings in certain circumstances.</p>
              <p>The court may grant remedies including damages.</p>
              <p>There are time limits on when proceedings under this Schedule may be commenced.</p>
              <p>This Schedule is intended to be read and construed separately from the rest of this Act.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-3">
            <num>3</num>
            <heading>Crown to be bound</heading>
            <content>
              <p>This Schedule binds the Crown in each of its capacities.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-4">
            <num>4</num>
            <heading>Constitutional basis of this Schedule</heading>
            <content>
              <p>This Schedule relies on the Commonwealth’s legislative powers under paragraph 51(xxix) of the Constitution to give effect to Australia’s obligations under the International Covenant on Civil and Political Rights.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-5">
            <num>5</num>
            <heading>Additional operation of this Schedule</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-5__subclause-1">
              <num>1</num>
              <content>
                <p>In addition to clause 4, this Schedule also has effect as provided by this clause.</p>
              </content>
            </hcontainer>
            <content>
              <p>Communications</p>
              <p>Corporations</p>
              <p>Territories</p>
              <p>Trade and commerce</p>
              <p>Banking and insurance</p>
              <p>Incidental</p>
            </content>
            <hcontainer name="subclause" eId="schedule-3__clause-5__subclause-2">
              <num>2</num>
              <content>
                <p>This Schedule also has the effect it would have if a reference in this Schedule to an invasion of privacy were expressly confined to an invasion of privacy using a service to which paragraph 51(v) of the Constitution applies.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-5__subclause-3">
              <num>3</num>
              <content>
                <p>This Schedule also has the effect it would have if a reference in this Schedule to an invasion of privacy were expressly confined to an invasion of privacy by or on behalf of a corporation to which paragraph 51(xx) of the Constitution applies.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-5__subclause-4">
              <num>4</num>
              <content>
                <p>This Schedule also has the effect it would have if a reference in this Schedule to an invasion of privacy were expressly confined to an invasion of privacy in a Territory.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-5__subclause-5">
              <num>5</num>
              <content>
                <p>This Schedule also has the effect it would have if a reference in this Schedule to an invasion of privacy were expressly confined to an invasion of privacy in the course of trade or commerce:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-5__para-a">
              <num>a</num>
              <content>
                <p>between Australia and places outside Australia; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-5__para-b">
              <num>b</num>
              <content>
                <p>among the States; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-5__para-c">
              <num>c</num>
              <content>
                <p>between a State and a Territory; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-5__para-d">
              <num>d</num>
              <content>
                <p>between 2 Territories.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-5__subclause-6">
              <num>6</num>
              <content>
                <p>This Schedule also has the effect it would have if a reference in this Schedule to an invasion of privacy were expressly confined to an invasion of privacy in the course of the carrying on of:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-5__para-a">
              <num>a</num>
              <content>
                <p>the business of banking, other than State banking (within the meaning of paragraph 51(xiii) of the Constitution) not extending beyond the limits of the State concerned; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-5__para-b">
              <num>b</num>
              <content>
                <p>the business of insurance, other than State insurance (within the meaning of paragraph 51(xiv) of the Constitution) not extending beyond the limits of the State concerned.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-5__subclause-7">
              <num>7</num>
              <content>
                <p>This Schedule also has the effect it would have if a reference in this Schedule to an invasion of privacy were expressly confined to an invasion of privacy incidental to the execution of any of the legislative powers of the Parliament or the executive power of the Commonwealth.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-6">
            <num>6</num>
            <heading>Interpretation</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-6__subclause-1">
              <num>1</num>
              <content>
                <p>In this Schedule:</p>
              </content>
            </hcontainer>
            <content>
              <p><b><i>agency</i></b> has the meaning given by subsection 6(1) of this Act.</p>
              <p><b><i>ASIO affiliate</i></b> has the same meaning as in the <i>Australian Security Intelligence Organisation Act 1979</i>.</p>
              <p><b><i>Australian Geospatial</i></b><b><i>-</i></b><b><i>Intelligence Organisation</i></b> means that part of the Defence Department known as the Australian Geospatial-Intelligence Organisation.</p>
              <p><b><i>Australian law</i></b> has the meaning given by subsection 6(1) of this Act.</p>
              <p><b><i>court/tribunal order</i></b> has the meaning given by subsection 6(1) of this Act.</p>
              <p><b><i>Defence Department</i></b> means the Department administered by the Minister administering Part III of the <i>Defence Act 1903</i>.</p>
              <p><b><i>Defence Intelligence Organisation</i></b> means that part of the Defence Department known as the Defence Intelligence Organisation.</p>
              <p><b><i>intelligence agency</i></b> means:</p>
              <p><b><i>International Covenant on Civil and Political Rights</i></b> means the International Covenant on Civil and Political Rights done at New York on 16 December 1966, as in force for Australia from time to time.</p>
              <p>Note:	The Covenant is in Australian Treaty Series 1980 No. 23 ([1980] ATS 23) and could in 2024 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).</p>
              <p><b><i>intruding upon the seclusion</i></b> of an individual includes, but is not limited to, the following:</p>
              <p><b><i>journalist</i></b> has the meaning given by subclause 15(2).</p>
              <p><b><i>journalistic material</i></b> has the meaning given by subclause 15(3).</p>
              <p><b><i>law enforcement body</i></b> means:</p>
              <p><b><i>misusing information</i></b> that relates to an individual includes, but is not limited to, collecting, using or disclosing information about the individual.</p>
              <p><b><i>reckless</i></b> has the same meaning as in the <i>Criminal Code</i>.</p>
              <p><b><i>staff member</i></b> of an agency or State or Territory authority<i> </i>(including an intelligence agency or a law enforcement body) includes:</p>
              <p><b><i>State or Territory authority</i></b> has the meaning given by section 6C of this Act.</p>
            </content>
            <paragraph eId="schedule-3__clause-6__para-a">
              <num>a</num>
              <content>
                <p>	(a)	the agency known as the Australian Criminal Intelligence Commission established by the <i>Australian Crime Commission Act 2002</i>; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-b">
              <num>b</num>
              <content>
                <p>the Australian Geospatial-Intelligence Organisation; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-c">
              <num>c</num>
              <content>
                <p>the Australian Secret Intelligence Service; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-d">
              <num>d</num>
              <content>
                <p>the Australian Security Intelligence Organisation; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-e">
              <num>e</num>
              <content>
                <p>the Australian Signals Directorate; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-f">
              <num>f</num>
              <content>
                <p>the Defence Intelligence Organisation; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-g">
              <num>g</num>
              <content>
                <p>the Office of National Intelligence.</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-a">
              <num>a</num>
              <content>
                <p>physically intruding into the person’s private space;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-b">
              <num>b</num>
              <content>
                <p>watching, listening to or recording the person’s private activities or private affairs.</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-a">
              <num>a</num>
              <content>
                <p>the Australian Federal Police; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-b">
              <num>b</num>
              <content>
                <p>the National Anti-Corruption Commissioner; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-c">
              <num>c</num>
              <content>
                <p>the Australian Crime Commission; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-d">
              <num>d</num>
              <content>
                <p>a police force or service of a State or a Territory; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-e">
              <num>e</num>
              <content>
                <p>the New South Wales Crime Commission; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-f">
              <num>f</num>
              <content>
                <p>the Independent Commission Against Corruption of New South Wales; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-g">
              <num>g</num>
              <content>
                <p>the Law Enforcement Conduct Commission of New South Wales; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-h">
              <num>h</num>
              <content>
                <p>the Independent Broad-based Anti-corruption Commission of Victoria; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-i">
              <num>i</num>
              <content>
                <p>the Crime and Corruption Commission of Queensland; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-j">
              <num>j</num>
              <content>
                <p>the Corruption and Crime Commission of Western Australia; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-k">
              <num>k</num>
              <content>
                <p>the Independent Commissioner Against Corruption of South Australia.</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-a">
              <num>a</num>
              <content>
                <p>	(a)	the head (however described) of the agency<i> </i>or authority, or another person who holds an office or appointment in relation to the agency<i> </i>or authority; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-b">
              <num>b</num>
              <content>
                <p>	(b)	a person who is otherwise a member of the staff of the agency or authority<i> </i>(whether an employee of the agency or authority, a consultant or contractor to the agency or authority, or a person who is made available to perform services for the agency or authority by another agency or authority, or another person); and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-c">
              <num>c</num>
              <content>
                <p>in the case of the Australian Federal Police—a member or special member of the Australian Federal Police; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-6__para-d">
              <num>d</num>
              <content>
                <p>in the case of a police force of a State or Territory—a member (however described) of that police force.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-6__subclause-2">
              <num>2</num>
              <content>
                <p>In determining the meaning of an expression used in a provision of this Schedule, an expression used in the rest of this Act is to be disregarded (unless a provision of this Schedule expressly provides otherwise).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-6__subclause-3">
              <num>3</num>
              <content>
                <p>In determining the meaning of a provision of this Schedule, the rest of this Act is to be disregarded.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-7">
            <num>7</num>
            <heading>Cause of action</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-7__subclause-1">
              <num>1</num>
              <content>
                <p>	(1)	An individual (the <b><i>plaintiff</i></b>) has a cause of action in tort against another person (the <b><i>defendant</i></b>) if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-7__para-a">
              <num>a</num>
              <content>
                <p>the defendant invaded the plaintiff’s privacy by doing one or both of the following:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-i">
              <num>i</num>
              <content>
                <p>intruding upon the plaintiff’s seclusion;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-ii">
              <num>ii</num>
              <content>
                <p>misusing information that relates to the plaintiff; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-b">
              <num>b</num>
              <content>
                <p>a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-c">
              <num>c</num>
              <content>
                <p>the invasion of privacy was intentional or reckless; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-d">
              <num>d</num>
              <content>
                <p>the invasion of privacy was serious; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-e">
              <num>e</num>
              <content>
                <p>the public interest in the plaintiff’s privacy outweighed any countervailing public interest.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-7__subclause-2">
              <num>2</num>
              <content>
                <p>The invasion of privacy is actionable without proof of damage.</p>
              </content>
            </hcontainer>
            <content>
              <p>Countervailing public interest</p>
              <p>Reasonable expectation of privacy</p>
              <p>Seriousness</p>
              <p>Untrue information</p>
            </content>
            <hcontainer name="subclause" eId="schedule-3__clause-7__subclause-3">
              <num>3</num>
              <content>
                <p>Without limiting what constitutes a countervailing public interest, any of the following matters of public interest may constitute a countervailing public interest:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-7__para-a">
              <num>a</num>
              <content>
                <p>freedom of expression, including political communication and artistic expression;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-b">
              <num>b</num>
              <content>
                <p>freedom of the media;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-c">
              <num>c</num>
              <content>
                <p>the proper administration of government;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-d">
              <num>d</num>
              <content>
                <p>open justice;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-e">
              <num>e</num>
              <content>
                <p>public health and safety;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-f">
              <num>f</num>
              <content>
                <p>national security;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-g">
              <num>g</num>
              <content>
                <p>the prevention and detection of crime and fraud.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-7__subclause-5">
              <num>5</num>
              <content>
                <p>Without limiting the matters that the court may consider in determining whether a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances, the court may consider the following:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-7__para-a">
              <num>a</num>
              <content>
                <p>the means, including the use of any device or technology, used to invade the plaintiff’s privacy;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-b">
              <num>b</num>
              <content>
                <p>the purpose of the invasion of privacy;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-c">
              <num>c</num>
              <content>
                <p>attributes of the plaintiff including the plaintiff’s age, occupation or cultural background;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-d">
              <num>d</num>
              <content>
                <p>the conduct of the plaintiff, including whether the plaintiff invited publicity or manifested a desire for privacy;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-e">
              <num>e</num>
              <content>
                <p>if the defendant invaded the plaintiff’s privacy by intruding upon the plaintiff’s seclusion—the place where the intrusion occurred;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-f">
              <num>f</num>
              <content>
                <p>if the defendant invaded the plaintiff’s privacy by misusing information that relates to the plaintiff—the following:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-i">
              <num>i</num>
              <content>
                <p>the nature of the information, including whether the information related to intimate or family matters, health or medical matters or financial matters;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-ii">
              <num>ii</num>
              <content>
                <p>how the information was held or communicated by the plaintiff;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-iii">
              <num>iii</num>
              <content>
                <p>whether and to what extent the information was already in the public domain.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-7__subclause-6">
              <num>6</num>
              <content>
                <p>Without limiting the matters that the court may consider in determining whether the invasion of privacy was serious, the court may consider the following:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-7__para-a">
              <num>a</num>
              <content>
                <p>the degree of any offence, distress or harm to dignity that the invasion of privacy was likely to cause to a person of ordinary sensibilities in the position of the plaintiff;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-b">
              <num>b</num>
              <content>
                <p>whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-7__para-c">
              <num>c</num>
              <content>
                <p>if the invasion of privacy was intentional—whether the defendant was motivated by malice.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-7__subclause-7">
              <num>7</num>
              <content>
                <p>If the defendant invaded the plaintiff’s privacy by misusing information that relates to the plaintiff, it is immaterial whether the information was true.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-8">
            <num>8</num>
            <heading>Defences</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-8__subclause-1">
              <num>1</num>
              <content>
                <p>It is a defence to the cause of action if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-8__para-a">
              <num>a</num>
              <content>
                <p>the invasion of privacy was required or authorised by or under an Australian law or court/tribunal order; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-8__para-b">
              <num>b</num>
              <content>
                <p>the plaintiff, or a person having lawful authority to do so for the plaintiff, expressly or impliedly consented to the invasion of privacy; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-8__para-c">
              <num>c</num>
              <content>
                <p>the defendant reasonably believed that the invasion of privacy was necessary to prevent or lessen a serious threat to the life, health or safety of a person; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-8__para-d">
              <num>d</num>
              <content>
                <p>the invasion of privacy was:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-8__para-i">
              <num>i</num>
              <content>
                <p>incidental to the exercise of a lawful right of defence of persons or property; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-8__para-ii">
              <num>ii</num>
              <content>
                <p>proportionate, necessary and reasonable.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-8__subclause-2">
              <num>2</num>
              <content>
                <p>It is also a defence to the cause of action if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-8__para-a">
              <num>a</num>
              <content>
                <p>the defendant invaded the plaintiff’s privacy by publishing, within the meaning of an Australian law that deals with defamation, information that relates to the plaintiff; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-8__para-b">
              <num>b</num>
              <content>
                <p>the Australian law provides for a related defence; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-8__para-c">
              <num>c</num>
              <content>
                <p>the defendant would be able to establish the related defence if a reference in the Australian law to the publication of defamatory matter were to include a reference to the invasion of privacy.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-8__subclause-3">
              <num>3</num>
              <content>
                <p>	(3)	Each of the following is a <b><i>related defence</i></b> for the purposes of this clause:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-8__para-a">
              <num>a</num>
              <content>
                <p>a defence of absolute privilege;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-8__para-b">
              <num>b</num>
              <content>
                <p>a defence for publication of public documents;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-8__para-c">
              <num>c</num>
              <content>
                <p>	(c)	a defence of fair report of proceedings of public concern<b>.</b></p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-8A">
            <num>8A</num>
            <heading>Determination whether exemption applies</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-8A__subclause-1">
              <num>1</num>
              <content>
                <p>The court may, at any stage of the proceedings, determine whether an exemption in <ref href="#part-3">Part 3</ref> applies in relation to the invasion of privacy.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-8A__subclause-2">
              <num>2</num>
              <content>
                <p>The court may make the determination on application of a party to the proceedings or on its own motion.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-8A__subclause-3">
              <num>3</num>
              <content>
                <p>If a party to the proceedings applies for a determination under this clause before the trial for the proceedings commences, the court is to make the determination as soon as practicable, and before the trial commences, unless satisfied that there are special circumstances justifying the postponement of the determination to a later stage of the proceedings (including during the trial).</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-8A__subclause-4">
              <num>4</num>
              <content>
                <p>This clause does not limit any powers that the court has apart from this clause.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-9">
            <num>9</num>
            <heading>Injunctions</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-9__subclause-1">
              <num>1</num>
              <content>
                <p>The court may, at any stage of the proceedings, grant an injunction restraining the defendant from invading the plaintiff’s privacy.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-9__subclause-2">
              <num>2</num>
              <content>
                <p>If the invasion of privacy involves publishing information that relates to the plaintiff, the court must have particular regard to the public interest in the publication of the information when considering whether to grant the injunction.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-10">
            <num>10</num>
            <heading>Summary judgment</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-10__subclause-1">
              <num>1</num>
              <content>
                <p>The court may give judgment for the defendant if the court is satisfied that the plaintiff has no reasonable prospect of successfully prosecuting the proceedings.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-10__subclause-2">
              <num>2</num>
              <content>
                <p>This clause does not limit any powers that the court has apart from this clause.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-11">
            <num>11</num>
            <heading>Damages</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-11__subclause-1">
              <num>1</num>
              <content>
                <p>Subject to this clause, the court may award damages to the plaintiff.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-11__subclause-2">
              <num>2</num>
              <content>
                <p>The court must not award aggravated damages.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-11__subclause-3">
              <num>3</num>
              <content>
                <p>The court may award damages for emotional distress.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-11__subclause-4">
              <num>4</num>
              <content>
                <p>The court may award exemplary or punitive damages in exceptional circumstances.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-11__subclause-5">
              <num>5</num>
              <content>
                <p>The sum of:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-11__para-a">
              <num>a</num>
              <content>
                <p>any damages awarded for non-economic loss; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-11__para-b">
              <num>b</num>
              <content>
                <p>any exemplary or punitive damages;</p>
              </content>
            </paragraph>
            <content>
              <p>must not exceed the greater of:</p>
            </content>
            <paragraph eId="schedule-3__clause-11__para-c">
              <num>c</num>
              <content>
                <p>$478,550; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-11__para-d">
              <num>d</num>
              <content>
                <p>the maximum amount of damages for non-economic loss that may be awarded in defamation proceedings under an Australian law.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-11__subclause-6">
              <num>6</num>
              <content>
                <p>Without limiting the matters that the court may consider in determining the amount of damages, the court may consider the following:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-11__para-a">
              <num>a</num>
              <content>
                <p>whether the defendant apologised to the plaintiff;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-11__para-b">
              <num>b</num>
              <content>
                <p>if the defendant invaded the plaintiff’s privacy by publishing information that relates to the plaintiff—whether the defendant published a correction;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-11__para-c">
              <num>c</num>
              <content>
                <p>whether the plaintiff received or agreed to receive compensation in relation to the invasion of privacy;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-11__para-d">
              <num>d</num>
              <content>
                <p>whether the plaintiff or the defendant took reasonable steps to settle the dispute;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-11__para-e">
              <num>e</num>
              <content>
                <p>whether the defendant engaged in conduct after the invasion of privacy, including during the proceedings, that was unreasonable and subjected the plaintiff to particular or additional embarrassment, harm, distress or humiliation.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-12">
            <num>12</num>
            <heading>Other remedies</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-12__subclause-1">
              <num>1</num>
              <content>
                <p>The court may grant such remedies, in addition to or instead of damages awarded in accordance with clause 11, as the court thinks most appropriate in the circumstances.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-12__subclause-2">
              <num>2</num>
              <content>
                <p>Without limiting subclause (1), those remedies may include one or more of the following:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-12__para-a">
              <num>a</num>
              <content>
                <p>an account of profits;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-12__para-b">
              <num>b</num>
              <content>
                <p>an injunction;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-12__para-c">
              <num>c</num>
              <content>
                <p>an order requiring the defendant to apologise to the plaintiff;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-12__para-d">
              <num>d</num>
              <content>
                <p>a correction order;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-12__para-e">
              <num>e</num>
              <content>
                <p>an order that any material (including copies):</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-12__para-i">
              <num>i</num>
              <content>
                <p>that is in the defendant’s possession, or that the defendant is able to retrieve; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-12__para-ii">
              <num>ii</num>
              <content>
                <p>that was obtained or made as a result of the invasion of privacy or was misused during the course of the invasion of privacy;</p>
              </content>
            </paragraph>
            <content>
              <p>be destroyed, be delivered up to the plaintiff or be dealt with as the court directs;</p>
            </content>
            <paragraph eId="schedule-3__clause-12__para-f">
              <num>f</num>
              <content>
                <p>a declaration that the defendant has seriously invaded the plaintiff’s privacy.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-13">
            <num>13</num>
            <heading>The effect of an apology on liability</heading>
            <content>
              <p>For the purposes of this Schedule, an apology made by or on behalf of the defendant in connection with the invasion of privacy:</p>
              <p>Note:	The court may consider whether the defendant apologised to the plaintiff in determining the amount of damages (if any) to award to the plaintiff (see paragraph 11(6)(a)).</p>
            </content>
            <paragraph eId="schedule-3__clause-13__para-a">
              <num>a</num>
              <content>
                <p>does not constitute an express or implied admission of fault or liability by the defendant in connection with the invasion of privacy; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-13__para-b">
              <num>b</num>
              <content>
                <p>is not relevant to the determination of fault or liability in connection with the invasion of privacy.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-14">
            <num>14</num>
            <heading>When proceedings must be commenced</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-14__subclause-1">
              <num>1</num>
              <content>
                <p>The plaintiff must commence proceedings under this Schedule:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-14__para-a">
              <num>a</num>
              <content>
                <p>if the plaintiff was under 18 years of age when the invasion of privacy occurred—before the plaintiff’<ref href="#sec-21">s 21</ref>st birthday; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-14__para-b">
              <num>b</num>
              <content>
                <p>otherwise—before the earlier of:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-14__para-i">
              <num>i</num>
              <content>
                <p>the day that is 1 year after the day on which the plaintiff became aware of the invasion of privacy; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-14__para-ii">
              <num>ii</num>
              <content>
                <p>the day that is 3 years after the invasion of privacy occurred.</p>
              </content>
            </paragraph>
            <content>
              <p>Note:	See also clause 19 (single publication rule).</p>
            </content>
            <hcontainer name="subclause" eId="schedule-3__clause-14__subclause-2">
              <num>2</num>
              <content>
                <p>However, the plaintiff may apply to the court for an order that, despite subclause (1), the plaintiff may commence proceedings under this Schedule before a day specified in the order.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-14__subclause-3">
              <num>3</num>
              <content>
                <p>The court may make the order if the court is satisfied that it was not reasonable in the circumstances for the plaintiff to have commenced proceedings in accordance with subclause (1) in relation to the invasion of privacy.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-14__subclause-4">
              <num>4</num>
              <content>
                <p>The day specified in the order must not be later than 6 years after the day on which the invasion of privacy occurred.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-15">
            <num>15</num>
            <heading>Journalists etc.</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-15__subclause-1">
              <num>1</num>
              <content>
                <p>This Schedule does not apply to an invasion of privacy by any of the following to the extent that the invasion of privacy involves the collection, preparation for publication or publication of journalistic material:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-15__para-a">
              <num>a</num>
              <content>
                <p>a journalist;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-15__para-b">
              <num>b</num>
              <content>
                <p>an employer of, or a person engaging, a journalist;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-15__para-c">
              <num>c</num>
              <content>
                <p>a person assisting a journalist who is employed or engaged by:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-15__para-i">
              <num>i</num>
              <content>
                <p>the journalist’s employer; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-15__para-ii">
              <num>ii</num>
              <content>
                <p>a person engaging the journalist;</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-15__para-d">
              <num>d</num>
              <content>
                <p>a person assisting a journalist in the person’s professional capacity.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-15__subclause-1A">
              <num>1A</num>
              <content>
                <p>This Schedule does not apply to an invasion of privacy to the extent that the invasion of privacy involves the publication or distribution of journalistic material that was prepared for publication by a journalist.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-15__subclause-2">
              <num>2</num>
              <content>
                <p>	(2)	A <b><i>journalist</i></b> is a person who:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-15__para-a">
              <num>a</num>
              <content>
                <p>works in a professional capacity as a journalist; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-15__para-b">
              <num>b</num>
              <content>
                <p>is subject to:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-15__para-i">
              <num>i</num>
              <content>
                <p>standards of professional conduct that apply to journalists; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-15__para-ii">
              <num>ii</num>
              <content>
                <p>a code of practice that applies to journalists.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-15__subclause-3">
              <num>3</num>
              <content>
                <p>	(3)	Material is <b><i>journalistic material</i></b> if it:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-15__para-a">
              <num>a</num>
              <content>
                <p>has the character of news, current affairs or a documentary; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-15__para-b">
              <num>b</num>
              <content>
                <p>consists of commentary or opinion on, or analysis of, news, current affairs or a documentary; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-15__para-c">
              <num>c</num>
              <content>
                <p>consists of editorial content relating to news, current affairs or a documentary.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-15__subclause-4">
              <num>4</num>
              <content>
                <p>For the purposes of this clause, if a journalist invades an individual’s privacy, it is immaterial whether the invasion of privacy breaches the standards or the code of practice to which the journalist is subject.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-16">
            <num>16</num>
            <heading>Agencies and State and Territory authorities (other than intelligence agencies and law enforcement bodies)</heading>
            <content>
              <p>This Schedule does not apply to an invasion of an individual’s privacy by an agency or a State or Territory authority (other than an intelligence agency or a law enforcement body) to the extent that the agency or authority invades the individual’s privacy, in good faith:</p>
            </content>
            <paragraph eId="schedule-3__clause-16__para-a">
              <num>a</num>
              <content>
                <p>	(a)	in the performance or purported performance of a function of the agency<i> </i>or authority; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-16__para-b">
              <num>b</num>
              <content>
                <p>in the exercise or purported exercise of a power of the agency or authority.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-16A">
            <num>16A</num>
            <heading>Staff members of agencies or State and Territory authorities (other than intelligence agencies and law enforcement bodies)</heading>
            <content>
              <p>This Schedule does not apply to an invasion of an individual’s privacy by a staff member of an agency or a State or Territory authority (other than a staff member of an intelligence agency or a law enforcement body) to the extent that the staff member invades the individual’s privacy, in good faith:</p>
            </content>
            <paragraph eId="schedule-3__clause-16A__para-a">
              <num>a</num>
              <content>
                <p>	(a)	in the performance or purported performance of a function of the agency<i> </i>or authority; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-16A__para-b">
              <num>b</num>
              <content>
                <p>in the exercise or purported exercise of a power of the agency or authority.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-16B">
            <num>16B</num>
            <heading>Law enforcement bodies</heading>
            <content>
              <p>This Schedule does not apply to:</p>
            </content>
            <paragraph eId="schedule-3__clause-16B__para-a">
              <num>a</num>
              <content>
                <p>an invasion of privacy by a law enforcement body; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-16B__para-b">
              <num>b</num>
              <content>
                <p>an invasion of privacy by a person who is a staff member of a law enforcement body in the performance of the person’s duties, powers or functions as such a staff member; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-16B__para-c">
              <num>c</num>
              <content>
                <p>an invasion of privacy to the extent that it involves a disclosure of information to a law enforcement body; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-16B__para-d">
              <num>d</num>
              <content>
                <p>an invasion of privacy to the extent that it involves information that was disclosed by a law enforcement body.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-17">
            <num>17</num>
            <heading>Intelligence agencies</heading>
            <content>
              <p>This Schedule does not apply to:</p>
            </content>
            <paragraph eId="schedule-3__clause-17__para-a">
              <num>a</num>
              <content>
                <p>an invasion of privacy by an intelligence agency; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-17__para-aa">
              <num>aa</num>
              <content>
                <p>an invasion of privacy by a person who is an ASIO affiliate, or an agent or staff member of an intelligence agency, in the performance of:</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-17__para-i">
              <num>i</num>
              <content>
                <p>if the person is an ASIO affiliate—functions or services for the Australian Security Intelligence Organisation; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-17__para-ii">
              <num>ii</num>
              <content>
                <p>otherwise—the person’s duties, powers or functions as such an agent or staff member; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-17__para-b">
              <num>b</num>
              <content>
                <p>an invasion of privacy to the extent that it involves a disclosure of information to an intelligence agency; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-17__para-c">
              <num>c</num>
              <content>
                <p>an invasion of privacy to the extent that it involves information that was disclosed by an intelligence agency.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-18">
            <num>18</num>
            <heading>Persons under 18</heading>
            <content>
              <p>This Schedule does not apply to an invasion of privacy by a person who is under 18 years of age.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-19">
            <num>19</num>
            <heading>Single publication rule</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-19__subclause-1">
              <num>1</num>
              <content>
                <p>This clause applies if:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-19__para-a">
              <num>a</num>
              <content>
                <p>	(a)	a publisher publishes information that relates to an individual to the public (the <b><i>first publication</i></b>); and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-19__para-b">
              <num>b</num>
              <content>
                <p>	(b)	the publisher or an associate of the publisher subsequently publishes (whether or not to the public) information that is substantially the same (the <b><i>subsequent publication</i></b>); and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-19__para-c">
              <num>c</num>
              <content>
                <p>the manner of the subsequent publication is not materially different from the manner of the first publication.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-19__subclause-2">
              <num>2</num>
              <content>
                <p>If an invasion of the individual’s privacy consists of the first publication or the subsequent publication, the invasion of privacy is taken to occur on the day of the first publication for the purposes of this Schedule.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-19__subclause-3">
              <num>3</num>
              <content>
                <p>In determining whether the manner of the subsequent publication is materially different from the manner of the first publication, the court may have regard to:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-19__para-a">
              <num>a</num>
              <content>
                <p>the level of prominence that the information is given; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-19__para-b">
              <num>b</num>
              <content>
                <p>the extent of the subsequent publication.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-19__subclause-4">
              <num>4</num>
              <content>
                <p>In this clause:</p>
              </content>
            </hcontainer>
            <content>
              <p><b><i>associate</i></b>, of a publisher, means:</p>
              <p><b><i>associated entity</i></b> has the same meaning as in the <i>Corporations Act 2001</i>.</p>
            </content>
            <paragraph eId="schedule-3__clause-19__para-a">
              <num>a</num>
              <content>
                <p>an employee of the publisher; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-19__para-b">
              <num>b</num>
              <content>
                <p>a person who publishes information as a contractor of the publisher; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-19__para-c">
              <num>c</num>
              <content>
                <p>an associated entity of the publisher; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-19__para-d">
              <num>d</num>
              <content>
                <p>an employee of an associated entity of the publisher; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-19__para-e">
              <num>e</num>
              <content>
                <p>a person who publishes information as a contractor of an associated entity of the publisher.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-20">
            <num>20</num>
            <heading>Deceased persons</heading>
            <hcontainer name="subclause" eId="schedule-3__clause-20__subclause-1">
              <num>1</num>
              <content>
                <p>A person (including a personal representative of a deceased person) cannot assert, continue or enforce an action under this Schedule in relation to:</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-20__para-a">
              <num>a</num>
              <content>
                <p>an invasion of the privacy of a deceased person (whether occurring before or after the deceased person’s death); or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-20__para-b">
              <num>b</num>
              <content>
                <p>an invasion of privacy by a person who has died.</p>
              </content>
            </paragraph>
            <hcontainer name="subclause" eId="schedule-3__clause-20__subclause-2">
              <num>2</num>
              <content>
                <p>Nothing in this clause prevents the court, if it considers it in the interests of justice to do so, from determining the question of costs for proceedings discontinued because of this clause.</p>
              </content>
            </hcontainer>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-21">
            <num>21</num>
            <heading>Saving of other laws and remedies</heading>
            <content>
              <p>This Schedule is not intended to exclude or limit the concurrent operation of any law, whether written or unwritten, of a State or a Territory.</p>
            </content>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-22">
            <num>22</num>
            <heading>Intervention of Information Commissioner</heading>
            <content>
              <p><role refersTo="#information-commissioner">The Information Commissioner</role> may, with the leave of the court:</p>
            </content>
            <paragraph eId="schedule-3__clause-22__para-a">
              <num>a</num>
              <content>
                <p>intervene in proceedings under this Schedule; or</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-22__para-b">
              <num>b</num>
              <content>
                <p>assist the court as amicus curiae.</p>
              </content>
            </paragraph>
          </hcontainer>
          <hcontainer name="clause" eId="schedule-3__clause-23">
            <num>23</num>
            <heading>Jurisdiction</heading>
            <content>
              <p>Federal and State courts</p>
              <p>Note:	State courts and the Federal Court of Australia also have jurisdiction in relation to matters arising under this Schedule (see subsection 39(2) and paragraph 39B(1A)(c) of the <i>Judiciary Act 1903</i>).</p>
              <p>Territory courts</p>
            </content>
            <hcontainer name="subclause" eId="schedule-3__clause-23__subclause-1">
              <num>1</num>
              <content>
                <p>Jurisdiction is conferred on the Federal Circuit and Family Court of Australia (<ref href="#dvs-2">Division 2</ref>) in relation to matters arising under this Schedule.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-23__subclause-2">
              <num>2</num>
              <content>
                <p>Jurisdiction is conferred on the courts of the Territories in relation to matters arising under this Schedule.</p>
              </content>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-3__clause-23__subclause-3">
              <num>3</num>
              <content>
                <p>Jurisdiction is conferred under subclause (2):</p>
              </content>
            </hcontainer>
            <paragraph eId="schedule-3__clause-23__para-a">
              <num>a</num>
              <content>
                <p>only so far as the Constitution permits; and</p>
              </content>
            </paragraph>
            <paragraph eId="schedule-3__clause-23__para-b">
              <num>b</num>
              <content>
                <p>within the limits (other than limits of locality) of the jurisdiction of the court (whether those limits are limits as to subject matter or otherwise).</p>
              </content>
            </paragraph>
          </hcontainer>
        </hcontainer>
      </attachment>
      <attachment>
        <hcontainer name="schedule" eId="schedule-4">
          <heading>Doxxing offences</heading>
          <content>
            <p>Criminal Code Act 1995</p>
          </content>
          <hcontainer name="clause" eId="schedule-4__clause-1">
            <num>1</num>
            <heading>After section 474.17B of the Criminal Code</heading>
            <content>
              <p>Insert:</p>
              <p>Note:	Publishing the name, image and telephone number of an individual on a website and encouraging others to repeatedly contact the individual with violent or threatening messages is an example of conduct (commonly referred to as doxxing) that is covered by this subsection.</p>
              <p>Penalty:	<quantity refersTo="#custodialSentence">Imprisonment for 6 years</quantity>.</p>
              <p>Note:	Publishing the names, images and residential addresses of members of a private online religious discussion group across multiple websites and encouraging others to attend those addresses and block entryways, or otherwise harass the members of that group, is an example of conduct (commonly referred to as doxxing) that is covered by this subsection.</p>
              <p>Penalty:	<quantity refersTo="#custodialSentence">Imprisonment for 7 years</quantity>.</p>
            </content>
            <hcontainer name="subclause" eId="schedule-4__clause-1__subclause-474-17C">
              <num>474.17C</num>
              <heading>Using a carriage service to make available etc. personal data of one or more individuals</heading>
              <hcontainer name="subclause" eId="schedule-4__clause-1__subclause-474-17C__subclause-1">
                <num>1</num>
                <content>
                  <p>A person commits an offence if:</p>
                </content>
              </hcontainer>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-a">
                <num>a</num>
                <content>
                  <p>the person uses a carriage service to make available, publish or otherwise distribute information; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-b">
                <num>b</num>
                <content>
                  <p>the information is personal data of one or more individuals; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-c">
                <num>c</num>
                <content>
                  <p>the person engages in the conduct in a way that reasonable persons would regard as being, in all the circumstances, menacing or harassing towards those individuals.</p>
                </content>
              </paragraph>
              <hcontainer name="subclause" eId="schedule-4__clause-1__subclause-474-17C__subclause-2">
                <num>2</num>
                <content>
                  <p>	(2)	For the purposes of paragraph (1)(b), <b><i>personal data</i></b> of an individual means information about the individual that enables the individual to be identified, contacted or located, and includes the following:</p>
                </content>
              </hcontainer>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-a">
                <num>a</num>
                <content>
                  <p>the name of the individual;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-b">
                <num>b</num>
                <content>
                  <p>a photograph or other image of the individual;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-c">
                <num>c</num>
                <content>
                  <p>a telephone number of the individual;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-d">
                <num>d</num>
                <content>
                  <p>an email address of the individual;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-e">
                <num>e</num>
                <content>
                  <p>an online account of the individual;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-f">
                <num>f</num>
                <content>
                  <p>a residential address of the individual;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-g">
                <num>g</num>
                <content>
                  <p>a work or business address of the individual;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-h">
                <num>h</num>
                <content>
                  <p>a place of education of the individual;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17C__para-i">
                <num>i</num>
                <content>
                  <p>a place of worship of the individual.</p>
                </content>
              </paragraph>
            </hcontainer>
            <hcontainer name="subclause" eId="schedule-4__clause-1__subclause-474-17D">
              <num>474.17D</num>
              <heading>Using a carriage service to make available etc. personal data of one or more members of certain groups</heading>
              <hcontainer name="subclause" eId="schedule-4__clause-1__subclause-474-17D__subclause-1">
                <num>1</num>
                <content>
                  <p>A person commits an offence if:</p>
                </content>
              </hcontainer>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-a">
                <num>a</num>
                <content>
                  <p>the person uses a carriage service to make available, publish or otherwise distribute information; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-b">
                <num>b</num>
                <content>
                  <p>the information is personal data of one or more members of a group; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-c">
                <num>c</num>
                <content>
                  <p>the person engages in the conduct in whole or in part because of the person’s belief that the group is distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin; and</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-d">
                <num>d</num>
                <content>
                  <p>the person engages in the conduct in a way that reasonable persons would regard as being, in all the circumstances, menacing or harassing towards those members.</p>
                </content>
              </paragraph>
              <hcontainer name="subclause" eId="schedule-4__clause-1__subclause-474-17D__subclause-2">
                <num>2</num>
                <content>
                  <p>	(2)	For the purposes of paragraph (1)(b), <b><i>personal data</i></b> of one or more members of a group means information about the members that enables the members to be identified, contacted or located, and includes the following:</p>
                </content>
              </hcontainer>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-a">
                <num>a</num>
                <content>
                  <p>the names of the members;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-b">
                <num>b</num>
                <content>
                  <p>photographs or other images of the members;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-c">
                <num>c</num>
                <content>
                  <p>telephone numbers of the members;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-d">
                <num>d</num>
                <content>
                  <p>email addresses of the members;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-e">
                <num>e</num>
                <content>
                  <p>online accounts of the members;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-f">
                <num>f</num>
                <content>
                  <p>residential addresses of the members;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-g">
                <num>g</num>
                <content>
                  <p>work or business addresses of the members;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-h">
                <num>h</num>
                <content>
                  <p>places of education of the members;</p>
                </content>
              </paragraph>
              <paragraph eId="schedule-4__clause-1__subclause-474-17D__para-i">
                <num>i</num>
                <content>
                  <p>places of worship of the members.</p>
                </content>
              </paragraph>
              <hcontainer name="subclause" eId="schedule-4__clause-1__subclause-474-17D__subclause-3">
                <num>3</num>
                <content>
                  <p>For the purposes of paragraph (1)(c), it is immaterial whether the group is actually distinguished by race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality or national or ethnic origin.</p>
                </content>
              </hcontainer>
              <content>
                <p>[<i>Minister’s second reading speech made in—</i></p>
                <p>
                  <i>House of Representatives on 12 September 2024</i>
                </p>
                <p><i>Senate on 18 November 2024</i>]</p>
                <p>(115/24)</p>
              </content>
            </hcontainer>
          </hcontainer>
        </hcontainer>
      </attachment>
    </attachments>
  </act>
</akomaNtoso>
